Analysis
- max time kernel
151s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
11/11/2022, 10:08
General
- Target Ziraat Bankasi Swift Mesaji20221111.exe
- Size 876KB
- Sample221111-l58xwaed54
- SHA256 aa7400a91906a2c688e83ea7fde82f284400e1aaa68dfaf87e6113768ec7f2b6
Malware Config
Extracted
-
formbook
-
qmpa
-
IEiN8oqOnNUEkfZd
-
LWyAr1P5PHPV
-
tMGP9gYCIc9DKQ==
-
fWi2stCh2E3DBWuEK612
-
B3LCCi2JvPxfNA==
-
NjLnNjX+DDWt/VuEK612
-
AvK5/JdMDLztPRg=
-
U+zn2FswDLztPRg=
-
3bRIXGwsIc9DKQ==
-
EXmAoj3/7Cyl+VuEK612
-
1gkKPklP1odxx7c/Zm+L6HeV4g==
-
1cMaHDg0ypV0vbT2Ibh+/5Cj5xmAVxA=
-
MSyBdIV+6nFRloTQAwmFklQ=
-
qilszGJvhMUsHgaUx/MNSKuo6A==
-
WYKLwmYEij4q2Hy6sOc=
-
sjII/IyFmORBFPJ2dVjpG0Q=
-
mTjzaRwZ9OsEkfZd
-
iL27vFhbX5ECbBIJxvJKbPHFf9M=
-
5A5Xr0D5PHPV
-
IpxsaTO4a1/I
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 4 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 8 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji20221111.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji20221111.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji20221111.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji20221111.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji20221111.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji20221111.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji20221111.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji20221111.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"4⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1972-159-0x0000000000E20000-0x0000000000E4D000-memory.dmp
memory/1972-157-0x00000000015C0000-0x000000000164F000-memory.dmp
memory/1972-154-0x0000000000DC0000-0x0000000000E1A000-memory.dmp
memory/1972-156-0x0000000000E20000-0x0000000000E4D000-memory.dmp
memory/1972-155-0x0000000001720000-0x0000000001A6A000-memory.dmp
memory/2156-146-0x00000000009F0000-0x0000000000A00000-memory.dmp
memory/2156-152-0x0000000000401000-0x000000000042E000-memory.dmp
memory/2156-143-0x0000000000401000-0x000000000042E000-memory.dmp
memory/2156-145-0x0000000001270000-0x00000000015BA000-memory.dmp
memory/2156-142-0x0000000000400000-0x000000000042E000-memory.dmp
memory/2156-148-0x0000000000400000-0x000000000042E000-memory.dmp
memory/2156-149-0x0000000001200000-0x0000000001210000-memory.dmp
memory/2156-140-0x0000000000400000-0x000000000042E000-memory.dmp
memory/2156-151-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3064-147-0x0000000007AF0000-0x0000000007BC8000-memory.dmp
memory/3064-150-0x0000000008090000-0x000000000820D000-memory.dmp
memory/3064-158-0x000000000A120000-0x000000000A294000-memory.dmp
memory/3064-160-0x000000000A120000-0x000000000A294000-memory.dmp
memory/4884-132-0x0000000000190000-0x0000000000270000-memory.dmp
memory/4884-136-0x000000000AE10000-0x000000000AEAC000-memory.dmp
memory/4884-135-0x0000000004C20000-0x0000000004C2A000-memory.dmp
memory/4884-134-0x00000000070B0000-0x0000000007142000-memory.dmp
memory/4884-133-0x00000000075C0000-0x0000000007B64000-memory.dmp