Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 08:44
Static task
static1
Behavioral task
behavioral1
Sample
ziraat bankasi swift mesaji.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ziraat bankasi swift mesaji.exe
Resource
win10v2004-20220901-en
General
-
Target
ziraat bankasi swift mesaji.exe
-
Size
213KB
-
MD5
50ae452a762aae14ccab1d1e56983307
-
SHA1
1fe167e21638f2891585d7e1498160e3d3720594
-
SHA256
3f3f17de70e897ba762f6a6073b6716a4fc01e04ea0038a4f01ce7842c7d8a74
-
SHA512
9c36098e536cd242f99ba1eeb5a4606a823e95aef7d0d854e26bca9945cb134c9e8d9e137b63638aea985e23e6a82c9c8c061b3b1b56769f832b1ce9c1d9a8b1
-
SSDEEP
3072:GB0z1qxbki54KcMcc+4bIsJUWGTBPZFyfShcP:GB0z1qU7c+4Hql
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5576673774:AAF__hFRh9bcJV72HkFb-9eZR9JNNyuOmFM/sendMessage?chat_id=1194722650
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/1060-152-0x0000000000F60000-0x0000000000F7A000-memory.dmp family_stormkitty -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation ziraat bankasi swift mesaji.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Chtudj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tghkrpicfi\\Chtudj.exe\"" ziraat bankasi swift mesaji.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 42 icanhazip.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4788 set thread context of 5052 4788 ziraat bankasi swift mesaji.exe 92 PID 5052 set thread context of 1060 5052 ziraat bankasi swift mesaji.exe 93 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 AppLaunch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5048 powershell.exe 5048 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4788 ziraat bankasi swift mesaji.exe Token: SeDebugPrivilege 5048 powershell.exe Token: SeDebugPrivilege 1060 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5052 ziraat bankasi swift mesaji.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4788 wrote to memory of 5048 4788 ziraat bankasi swift mesaji.exe 86 PID 4788 wrote to memory of 5048 4788 ziraat bankasi swift mesaji.exe 86 PID 4788 wrote to memory of 5048 4788 ziraat bankasi swift mesaji.exe 86 PID 4788 wrote to memory of 5052 4788 ziraat bankasi swift mesaji.exe 92 PID 4788 wrote to memory of 5052 4788 ziraat bankasi swift mesaji.exe 92 PID 4788 wrote to memory of 5052 4788 ziraat bankasi swift mesaji.exe 92 PID 4788 wrote to memory of 5052 4788 ziraat bankasi swift mesaji.exe 92 PID 4788 wrote to memory of 5052 4788 ziraat bankasi swift mesaji.exe 92 PID 4788 wrote to memory of 5052 4788 ziraat bankasi swift mesaji.exe 92 PID 4788 wrote to memory of 5052 4788 ziraat bankasi swift mesaji.exe 92 PID 4788 wrote to memory of 5052 4788 ziraat bankasi swift mesaji.exe 92 PID 5052 wrote to memory of 1060 5052 ziraat bankasi swift mesaji.exe 93 PID 5052 wrote to memory of 1060 5052 ziraat bankasi swift mesaji.exe 93 PID 5052 wrote to memory of 1060 5052 ziraat bankasi swift mesaji.exe 93 PID 5052 wrote to memory of 1060 5052 ziraat bankasi swift mesaji.exe 93 PID 5052 wrote to memory of 1060 5052 ziraat bankasi swift mesaji.exe 93 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ziraat bankasi swift mesaji.exe"C:\Users\Admin\AppData\Local\Temp\ziraat bankasi swift mesaji.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
-
C:\Users\Admin\AppData\Local\Temp\ziraat bankasi swift mesaji.exe"C:\Users\Admin\AppData\Local\Temp\ziraat bankasi swift mesaji.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1060
-
-