52e3ee0168f34ab782a8103dc77814efe970b2a0fc5636a7266a4ea3e9bae2e7

Resubmissions

22-08-2022 13:50

220822-q5gwlsbeh5 3

22-08-2022 13:39

220822-qx9awsbea6 9

19-08-2022 15:22

220819-srv77afaer 10

Analysis

max time kernel
151s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-08-2022 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ziraat Bankasi Swift Mesaji.exe
Size

21KB
MD5

d865c75250a61c050f69dbb8735581a5
SHA1

3e7d1b0b961ea899e89902977e36b70fd92351a3
SHA256

52e3ee0168f34ab782a8103dc77814efe970b2a0fc5636a7266a4ea3e9bae2e7
SHA512

66f9439bd3f91e47ab4343147fe10d4a01fa1930b8533165744366c922865b59709683e9d453d5b2d80d12715bcb43b6898365026b12bda1817a4c8317d26500

Score

9^/10

discovery

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	900	Ziraat Bankasi Swift Mesaji.exe

C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-54-0x0000000001190000-0x000000000119C000-memory.dmp

Filesize
48KB

Download
memory/900-55-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download