Analysis
- max time kernel
151s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
10/11/2022, 12:31
General
- Target ZiraatBankasi-SwiftMesaji20221110.exe
- Size 765KB
- Sample221110-pp2qeabgcm
- SHA256 b271ec6f98a0ccdc009eea7a5c99970f9170ff653cb46c428d5bef6c3dcab1a4
Malware Config
Extracted
-
formbook
-
go5o
-
fS9ce6bj/U7J6Q==
-
KPSUZUVU42J3IaXPjqsA
-
cDR9Sz1n2BN9eTutNa2QNg==
-
POJskuyBUqUdVp2wiI8=
-
t9gcQ5yNydIfrO4=
-
9oakDnoh0VXC
-
o2Z9n/2iYtDFcJ2wiI8=
-
GLBJZsgVkt3eXZragNJjYiGQ
-
axuNlck5BkA8plrI
-
khk2/+G5g43K
-
Fauoa7FQG6EN2QyITg==
-
fgaVrOb4mLl1KGNUX6jkXCU=
-
HQkML53cm6Ae+zIhRg==
-
TBodPq4E4AJylpZiNa2QNg==
-
wHghSq49EVU54E8mChOvRi5W3cn3ItLVVw==
-
rET2JY8u+TgVpzRtRF54Kw==
-
b0mCXc5pcXHZ9A==
-
QfuIoOgHl9IfrO4=
-
87fV+WQT5IKlSnTqmb6SbSMctA==
-
E+Yg8EqQKJi9XJKVqrA2i9TO78H53I97
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZiraatBankasi-SwiftMesaji20221110.exe"C:\Users\Admin\AppData\Local\Temp\ZiraatBankasi-SwiftMesaji20221110.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ZiraatBankasi-SwiftMesaji20221110.exe"C:\Users\Admin\AppData\Local\Temp\ZiraatBankasi-SwiftMesaji20221110.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1224-141-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1224-143-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1224-144-0x0000000000401000-0x000000000042F000-memory.dmp
memory/1224-145-0x00000000013B0000-0x00000000016FA000-memory.dmp
memory/1420-135-0x0000000000B10000-0x0000000000BD6000-memory.dmp
memory/1420-136-0x0000000005C00000-0x00000000061A4000-memory.dmp
memory/1420-137-0x0000000005650000-0x00000000056E2000-memory.dmp
memory/1420-138-0x0000000005580000-0x000000000558A000-memory.dmp
memory/1420-139-0x0000000009520000-0x00000000095BC000-memory.dmp