Analysis
- max time kernel
60s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
11/11/2022, 10:08
General
- Target ZiraatBankasi_SwiftMesaji20221111.exe
- Size 876KB
- Sample221111-l58l4sed53
- SHA256 e4432b656843ac5be19e0d5d5e29cc57c855f0ec514b67d93d0e8603567e2ed5
Malware Config
Extracted
-
formbook
-
go5o
-
fS9ce6bj/U7J6Q==
-
KPSUZUVU42J3IaXPjqsA
-
cDR9Sz1n2BN9eTutNa2QNg==
-
POJskuyBUqUdVp2wiI8=
-
t9gcQ5yNydIfrO4=
-
9oakDnoh0VXC
-
o2Z9n/2iYtDFcJ2wiI8=
-
GLBJZsgVkt3eXZragNJjYiGQ
-
axuNlck5BkA8plrI
-
khk2/+G5g43K
-
Fauoa7FQG6EN2QyITg==
-
fgaVrOb4mLl1KGNUX6jkXCU=
-
HQkML53cm6Ae+zIhRg==
-
TBodPq4E4AJylpZiNa2QNg==
-
wHghSq49EVU54E8mChOvRi5W3cn3ItLVVw==
-
rET2JY8u+TgVpzRtRF54Kw==
-
b0mCXc5pcXHZ9A==
-
QfuIoOgHl9IfrO4=
-
87fV+WQT5IKlSnTqmb6SbSMctA==
-
E+Yg8EqQKJi9XJKVqrA2i9TO78H53I97
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZiraatBankasi_SwiftMesaji20221111.exe"C:\Users\Admin\AppData\Local\Temp\ZiraatBankasi_SwiftMesaji20221111.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ZiraatBankasi_SwiftMesaji20221111.exe"C:\Users\Admin\AppData\Local\Temp\ZiraatBankasi_SwiftMesaji20221111.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2252-133-0x0000000000950000-0x0000000000A30000-memory.dmp
memory/2252-134-0x0000000007C50000-0x00000000081F4000-memory.dmp
memory/2252-135-0x0000000007780000-0x0000000007812000-memory.dmp
memory/2252-136-0x0000000007770000-0x000000000777A000-memory.dmp
memory/2252-137-0x000000000B5D0000-0x000000000B66C000-memory.dmp
memory/5088-139-0x0000000000400000-0x000000000042F000-memory.dmp
memory/5088-141-0x0000000000400000-0x000000000042F000-memory.dmp
memory/5088-142-0x0000000000401000-0x000000000042F000-memory.dmp
memory/5088-143-0x0000000001890000-0x0000000001BDA000-memory.dmp