Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
28/07/2022, 15:56
Static task
static1
Behavioral task
behavioral1
Sample
Ziraat Bankas Swift Mesaj.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
Ziraat Bankas Swift Mesaj.exe
Resource
win10v2004-20220721-en
General
-
Target
Ziraat Bankas Swift Mesaj.exe
-
Size
434KB
-
MD5
49a315adc23495aea8ed27cfb1e74b2d
-
SHA1
df976bb5c6b4a444275bc45b863ef4e8e99c360e
-
SHA256
4355bf421266b0e7eafb3de8975d4aa925363c3adfe167fa550dcf02e56b6a64
-
SHA512
23d409c3638b592d94bb8dce46039a45870b79ec015892e7bf8a5892cc47d439f04cbfa4cdf7eab69619645e913c5793d15c22a349d3549e624145739943e706
Malware Config
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/1152-140-0x0000000001000000-0x000000000101A000-memory.dmp family_stormkitty -
Downloads MZ/PE file
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Application.lnk Ziraat Bankas Swift Mesaj.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 icanhazip.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4520 set thread context of 3228 4520 Ziraat Bankas Swift Mesaj.exe 82 PID 3228 set thread context of 1152 3228 Ziraat Bankas Swift Mesaj.exe 84 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 AppLaunch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4520 Ziraat Bankas Swift Mesaj.exe Token: SeDebugPrivilege 1152 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3228 Ziraat Bankas Swift Mesaj.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4520 wrote to memory of 3228 4520 Ziraat Bankas Swift Mesaj.exe 82 PID 4520 wrote to memory of 3228 4520 Ziraat Bankas Swift Mesaj.exe 82 PID 4520 wrote to memory of 3228 4520 Ziraat Bankas Swift Mesaj.exe 82 PID 4520 wrote to memory of 3228 4520 Ziraat Bankas Swift Mesaj.exe 82 PID 4520 wrote to memory of 3228 4520 Ziraat Bankas Swift Mesaj.exe 82 PID 4520 wrote to memory of 3228 4520 Ziraat Bankas Swift Mesaj.exe 82 PID 4520 wrote to memory of 3228 4520 Ziraat Bankas Swift Mesaj.exe 82 PID 4520 wrote to memory of 3228 4520 Ziraat Bankas Swift Mesaj.exe 82 PID 3228 wrote to memory of 1152 3228 Ziraat Bankas Swift Mesaj.exe 84 PID 3228 wrote to memory of 1152 3228 Ziraat Bankas Swift Mesaj.exe 84 PID 3228 wrote to memory of 1152 3228 Ziraat Bankas Swift Mesaj.exe 84 PID 3228 wrote to memory of 1152 3228 Ziraat Bankas Swift Mesaj.exe 84 PID 3228 wrote to memory of 1152 3228 Ziraat Bankas Swift Mesaj.exe 84 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankas Swift Mesaj.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankas Swift Mesaj.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankas Swift Mesaj.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankas Swift Mesaj.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1152
-
-