Analysis
- max time kernel
91s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
09/11/2022, 16:46
General
- Target ZiraatBankasiSwiftMesaji20221109.exe
- Size 907KB
- Sample221109-t912tsaeb8
- SHA256 fbb79193e65382a20980d8bbf01496be8dd9f1cceb9e253c95e102afd8d52cfc
Malware Config
Extracted
-
formbook
-
go5o
-
fS9ce6bj/U7J6Q==
-
KPSUZUVU42J3IaXPjqsA
-
cDR9Sz1n2BN9eTutNa2QNg==
-
POJskuyBUqUdVp2wiI8=
-
t9gcQ5yNydIfrO4=
-
9oakDnoh0VXC
-
o2Z9n/2iYtDFcJ2wiI8=
-
GLBJZsgVkt3eXZragNJjYiGQ
-
axuNlck5BkA8plrI
-
khk2/+G5g43K
-
Fauoa7FQG6EN2QyITg==
-
fgaVrOb4mLl1KGNUX6jkXCU=
-
HQkML53cm6Ae+zIhRg==
-
TBodPq4E4AJylpZiNa2QNg==
-
wHghSq49EVU54E8mChOvRi5W3cn3ItLVVw==
-
rET2JY8u+TgVpzRtRF54Kw==
-
b0mCXc5pcXHZ9A==
-
QfuIoOgHl9IfrO4=
-
87fV+WQT5IKlSnTqmb6SbSMctA==
-
E+Yg8EqQKJi9XJKVqrA2i9TO78H53I97
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZiraatBankasiSwiftMesaji20221109.exe"C:\Users\Admin\AppData\Local\Temp\ZiraatBankasiSwiftMesaji20221109.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ZiraatBankasiSwiftMesaji20221109.exe"C:\Users\Admin\AppData\Local\Temp\ZiraatBankasiSwiftMesaji20221109.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ZiraatBankasiSwiftMesaji20221109.exe"C:\Users\Admin\AppData\Local\Temp\ZiraatBankasiSwiftMesaji20221109.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1160-139-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1160-141-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1160-142-0x0000000000401000-0x000000000042F000-memory.dmp
memory/1160-143-0x0000000001680000-0x00000000019CA000-memory.dmp
memory/4884-132-0x0000000000F00000-0x0000000000FE8000-memory.dmp
memory/4884-133-0x0000000005E60000-0x0000000006404000-memory.dmp
memory/4884-134-0x0000000005990000-0x0000000005A22000-memory.dmp
memory/4884-135-0x0000000005A50000-0x0000000005A5A000-memory.dmp
memory/4884-136-0x0000000008020000-0x00000000080BC000-memory.dmp