Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22-03-2023 19:03
Static task
static1
Behavioral task
behavioral1
Sample
Ziraat Bankasi Swift Mesaji.exe
Resource
win7-20230220-en
General
-
Target
Ziraat Bankasi Swift Mesaji.exe
-
Size
311KB
-
MD5
17e860b41dc286806e477310a4cbef79
-
SHA1
221996f82df76554d7e7dc5e3f0426a2c768020d
-
SHA256
06243274174960778e1adac528d0c2641cf742fa2ba0759c9fe762f7a0692aff
-
SHA512
e07ca910adbce9478e97bf68c556874f4d5d6bce64530eae3abe5ef96b7af5b8d316ced1cf39980cc356f18f3a2ee18a6c419ee78322a2f45a1926aa027a5f10
-
SSDEEP
6144:hT5UzmTaDizyCSx6atVIt9lN9CaYf6XJ/tzklftBL7mCsVesYY4+NJTRK:hT55TwIlShVkN9U4VITl7mvYY4WJE
Malware Config
Extracted
formbook
4.1
mi94
realdigitalmarketing.co.uk
athle91.com
zetuinteriors.africa
jewelry2adore.biz
sneakersuomo.com
hotcoa.com
bestpetfinds.com
elatedfreedom.com
louisegoulet.com
licensescape.com
jenniferfalconerrealtor.com
xqan.net
textare.net
doctorlinkscsk.link
bizformspro.com
ameriealthcaritasfl.com
hanfengmeiye.com
anjin98.com
credit-cards-54889.com
dinero.news
naijastudy.africa
cursosweb22.online
furniture-61686.com
furniture-42269.com
emiu6696.com
herhustlenation.com
kevinjasperinc.africa
hear-aid-92727.com
goodlifeprojectofficial.com
freshteak.com
bellvaniamail.com
peterslawonline.com
analogfair.com
fornettobarbecues.com
6880365.com
couragetokingdom.com
luivix.online
3ay82.xyz
tmcgroup.africa
canadianbreederprogram.com
funtime28.online
customcarpentry.uk
anotherworldrecord.com
aux100000epices.com
edelman-production.com
honorproduct.com
danuzioneto.com
iltuosentiero.com
healthinsurancearena.com
hunterboots--canada.com
irestoreart.com
lapalmaaccesible.com
khbmfbank.africa
laxmi.digital
leqidt.tax
fluffyjet.online
chuckclouds.com
bril-kre-l25.buzz
centracul.online
legacyengravers.com
guesstheword.net
ded-morozvrn.online
lemonga.com
crrgbb.com
crosswalkconsulting.co.uk
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1260-84-0x0000000000400000-0x0000000001462000-memory.dmp formbook behavioral1/memory/1260-88-0x0000000000400000-0x0000000001462000-memory.dmp formbook behavioral1/memory/1528-98-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook behavioral1/memory/1528-100-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
Ziraat Bankasi Swift Mesaji.exeZiraat Bankasi Swift Mesaji.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe Ziraat Bankasi Swift Mesaji.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe Ziraat Bankasi Swift Mesaji.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1208 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exepid process 1296 Ziraat Bankasi Swift Mesaji.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Kbelyst\Intraselection\Strbemrkning23\Arcadianly.Blo132 Ziraat Bankasi Swift Mesaji.exe File opened for modification C:\Windows\SysWOW64\Weeds\Vederstyggeligste211\Dybgang.Aur Ziraat Bankasi Swift Mesaji.exe File opened for modification C:\Windows\SysWOW64\Nonreprehensibly.Ber Ziraat Bankasi Swift Mesaji.exe File opened for modification C:\Windows\SysWOW64\Agaver\Ngtelsers.ini Ziraat Bankasi Swift Mesaji.exe File opened for modification C:\Windows\SysWOW64\Tilkmpendes\Saxofonen.ini Ziraat Bankasi Swift Mesaji.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exepid process 1260 Ziraat Bankasi Swift Mesaji.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exeZiraat Bankasi Swift Mesaji.exepid process 1296 Ziraat Bankasi Swift Mesaji.exe 1260 Ziraat Bankasi Swift Mesaji.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exeZiraat Bankasi Swift Mesaji.exemsiexec.exedescription pid process target process PID 1296 set thread context of 1260 1296 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1260 set thread context of 1200 1260 Ziraat Bankasi Swift Mesaji.exe Explorer.EXE PID 1528 set thread context of 1200 1528 msiexec.exe Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exedescription ioc process File created C:\Windows\Fonts\Underdrain\skatteskemaers\Shodden\Kartonnagefabrikken.lnk Ziraat Bankasi Swift Mesaji.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exemsiexec.exepid process 1260 Ziraat Bankasi Swift Mesaji.exe 1260 Ziraat Bankasi Swift Mesaji.exe 1528 msiexec.exe 1528 msiexec.exe 1528 msiexec.exe 1528 msiexec.exe 1528 msiexec.exe 1528 msiexec.exe 1528 msiexec.exe 1528 msiexec.exe 1528 msiexec.exe 1528 msiexec.exe 1528 msiexec.exe 1528 msiexec.exe 1528 msiexec.exe 1528 msiexec.exe 1528 msiexec.exe 1528 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exeZiraat Bankasi Swift Mesaji.exemsiexec.exepid process 1296 Ziraat Bankasi Swift Mesaji.exe 1260 Ziraat Bankasi Swift Mesaji.exe 1260 Ziraat Bankasi Swift Mesaji.exe 1260 Ziraat Bankasi Swift Mesaji.exe 1528 msiexec.exe 1528 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exeExplorer.EXEmsiexec.exedescription pid process Token: SeDebugPrivilege 1260 Ziraat Bankasi Swift Mesaji.exe Token: SeShutdownPrivilege 1200 Explorer.EXE Token: SeDebugPrivilege 1528 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1296 wrote to memory of 1260 1296 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1296 wrote to memory of 1260 1296 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1296 wrote to memory of 1260 1296 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1296 wrote to memory of 1260 1296 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1296 wrote to memory of 1260 1296 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1200 wrote to memory of 1528 1200 Explorer.EXE msiexec.exe PID 1200 wrote to memory of 1528 1200 Explorer.EXE msiexec.exe PID 1200 wrote to memory of 1528 1200 Explorer.EXE msiexec.exe PID 1200 wrote to memory of 1528 1200 Explorer.EXE msiexec.exe PID 1200 wrote to memory of 1528 1200 Explorer.EXE msiexec.exe PID 1200 wrote to memory of 1528 1200 Explorer.EXE msiexec.exe PID 1200 wrote to memory of 1528 1200 Explorer.EXE msiexec.exe PID 1528 wrote to memory of 1208 1528 msiexec.exe cmd.exe PID 1528 wrote to memory of 1208 1528 msiexec.exe cmd.exe PID 1528 wrote to memory of 1208 1528 msiexec.exe cmd.exe PID 1528 wrote to memory of 1208 1528 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"2⤵
- Checks QEMU agent file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"3⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\DORME.iniFilesize
31B
MD53000f7f0f12b7139ea28160c52098e25
SHA19d032395f38d341881019b996e591160d542054b
SHA256467b09ff26622746d205628ae325ec9838461bc5fe741b3757bb39ddec87ecb1
SHA512a76a2f1e3686e2ffd03388ec7dbcd4afa6ae53ccd3aa40c6fbbf0c994eee5e2685d0c412f15ec4506c1175f5a84712e1a8b7ae32e6a0327e1ba47321a59e0ee2
-
\Users\Admin\AppData\Local\Temp\nst12B9.tmp\System.dllFilesize
12KB
MD5d968cb2b98b83c03a9f02dd9b8df97dc
SHA1d784c9b7a92dce58a5038beb62a48ff509e166a0
SHA256a4ec98011ef99e595912718c1a1bf1aa67bfc2192575729d42f559d01f67b95c
SHA5122ee41dc68f329a1519a8073ece7d746c9f3bf45d8ef3b915deb376af37e26074134af5f83c8af0fe0ab227f0d1acca9f37e5ca7ae37c46c3bcc0331fe5e2b97e
-
memory/1200-90-0x0000000004AA0000-0x0000000004C3F000-memory.dmpFilesize
1.6MB
-
memory/1200-104-0x0000000006320000-0x000000000644F000-memory.dmpFilesize
1.2MB
-
memory/1200-102-0x0000000004D30000-0x0000000004E30000-memory.dmpFilesize
1024KB
-
memory/1200-105-0x0000000006320000-0x000000000644F000-memory.dmpFilesize
1.2MB
-
memory/1200-108-0x0000000006320000-0x000000000644F000-memory.dmpFilesize
1.2MB
-
memory/1260-82-0x0000000000400000-0x0000000001462000-memory.dmpFilesize
16.4MB
-
memory/1260-88-0x0000000000400000-0x0000000001462000-memory.dmpFilesize
16.4MB
-
memory/1260-87-0x00000000350E0000-0x00000000350F5000-memory.dmpFilesize
84KB
-
memory/1260-86-0x0000000035550000-0x0000000035853000-memory.dmpFilesize
3.0MB
-
memory/1260-85-0x0000000001470000-0x00000000052AB000-memory.dmpFilesize
62.2MB
-
memory/1260-92-0x0000000001470000-0x00000000052AB000-memory.dmpFilesize
62.2MB
-
memory/1260-84-0x0000000000400000-0x0000000001462000-memory.dmpFilesize
16.4MB
-
memory/1260-81-0x0000000000400000-0x0000000001462000-memory.dmpFilesize
16.4MB
-
memory/1528-91-0x0000000000210000-0x0000000000224000-memory.dmpFilesize
80KB
-
memory/1528-100-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/1528-99-0x0000000002120000-0x0000000002423000-memory.dmpFilesize
3.0MB
-
memory/1528-103-0x0000000000A90000-0x0000000000B24000-memory.dmpFilesize
592KB
-
memory/1528-98-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/1528-97-0x0000000000210000-0x0000000000224000-memory.dmpFilesize
80KB
-
memory/1528-93-0x0000000000210000-0x0000000000224000-memory.dmpFilesize
80KB