Overview

overview

7

Static

static

1

Ziraat Ban...ji.exe

windows7-x64

7

Ziraat Ban...ji.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/04/2023, 12:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Ziraat Bankasi Swift Mesaji.exe
  • Size 600KB
  • Sample230403-pp3ygaef58
  • SHA256 c0303022c1e2e014df91a6ff93d540d2e734a938f93e16649941c418d54e5a62
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
    "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
    1⤵
    • Checks QEMU agent file
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
      "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
      2⤵
      • Checks QEMU agent file
      • Checks computer location settings
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      PID:3736
    • C:\Windows\SysWOW64\msdt.exe
      "C:\Windows\SysWOW64\msdt.exe"
      2⤵
        PID:2112

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nswB1E1.tmp\System.dll
          • Size 12KB
          • SHA256 a4ec98011ef99e595912718c1a1bf1aa67bfc2192575729d42f559d01f67b95c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          DORME.ini
          • Path C:\Users\Admin\AppData\Roaming\DORME.ini
          • Size 31B
          • SHA256 467b09ff26622746d205628ae325ec9838461bc5fe741b3757bb39ddec87ecb1
          • MD5 SHA1 SHA512
          Submit Download

          memory/2072-160-0x0000000035EF0000-0x0000000035FF9000-memory.dmp
          Download

          memory/3736-156-0x0000000000400000-0x0000000001654000-memory.dmp
          Download

          memory/3736-157-0x0000000000400000-0x0000000001654000-memory.dmp
          Download

          memory/3736-158-0x0000000001660000-0x00000000054DF000-memory.dmp
          Download

          memory/3736-159-0x0000000035920000-0x0000000035C6A000-memory.dmp
          Download

          memory/3736-161-0x0000000000400000-0x0000000001654000-memory.dmp
          Download