Analysis
- max time kernel
191s - max time network
201s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
08/11/2022, 15:36
General
- Target ZiraatbankasiSwiftMessaji001.exe
- Size 1019KB
- Sample221108-s1ydxaeba5
- SHA256 4c3d925669944dbdec6649638901b8ccb110c2ff971d8cf558ef05f9980ecf69
Malware Config
Extracted
-
formbook
-
s5zx
-
wMAY83Xf8pYlwmcLm5HvBdaL
-
CEtcpyGISM/CVFQ5zam3
-
jQE/nMmnXlmcTVQ5zam3
-
kUtRVpN/YY33wLfac81TKg==
-
WxtrRs8s52o/GPsPog==
-
w8LUN0UWABcTD1Hv
-
pCU+Wnk+6/E08im2Xo5y7uea
-
4o2dnKCJNOgbwud9JfMHrMJuAGI+fg==
-
AbPNtFXXpcoeyWB1WGC/AOiS
-
5Kbo75EKwcLiArHSoc/SIg==
-
IaICXWtqc2xvU++OXEd+tRitdw==
-
x0M6GKkDC8SPQGd/S61UdfgVZLqVDFg=
-
Y6TEJKsC3IxVJN986uJugqNcN7NO5EU=
-
rltiOepgaw3Mk0Lbt1yoxuA=
-
z94mjMxyFcLUu1Q=
-
xH3F3Hz93BCSMuBtI65JGm+VN3xm
-
+GO142npuuptGPsPog==
-
WX/VsE7R0FTm3Ju2ema/AOiS
-
qam0OKkfCyE6ZKxZtQ==
-
0ojGr0OMV9khz+4GoA==
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZiraatbankasiSwiftMessaji001.exe"C:\Users\Admin\AppData\Local\Temp\ZiraatbankasiSwiftMessaji001.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ZiraatbankasiSwiftMessaji001.exe"C:\Users\Admin\AppData\Local\Temp\ZiraatbankasiSwiftMessaji001.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3776-132-0x00000000002C0000-0x00000000003C6000-memory.dmp
memory/3776-133-0x0000000005380000-0x0000000005924000-memory.dmp
memory/3776-134-0x0000000004DD0000-0x0000000004E62000-memory.dmp
memory/3776-135-0x0000000004D80000-0x0000000004D8A000-memory.dmp
memory/3776-136-0x0000000008CA0000-0x0000000008D3C000-memory.dmp
memory/5016-138-0x0000000000400000-0x000000000042F000-memory.dmp
memory/5016-140-0x0000000000400000-0x000000000042F000-memory.dmp
memory/5016-141-0x0000000000401000-0x000000000042F000-memory.dmp
memory/5016-142-0x0000000001640000-0x000000000198A000-memory.dmp