Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2023 12:31
Static task
static1
Behavioral task
behavioral1
Sample
Ziraat Bankasi Swift Mesaji_pdf.exe
Resource
win7-20230220-en
General
-
Target
Ziraat Bankasi Swift Mesaji_pdf.exe
-
Size
367KB
-
MD5
b202fbf7da253a4eb12808791ad0a4c5
-
SHA1
04577bf9f9a526612533547eac8538eae371af2d
-
SHA256
cd24796ce83ec93f4e5e116d5402986cca52840cf878f7cdedc63f865734d409
-
SHA512
cb738d3c8b1a96ef652c1d3e6d0dad01ec174b5f5f772dff8ac522d92a0d91456ce8a7de6cf1846b6ecfbe73cbf56dfe5115daee591af6767127509a8229cb9c
-
SSDEEP
6144:wT5Uzm/ONiIvlIxyOPZ06YUOHB/ZXIsy9/l/uzYf5CW1CQ64B6GuWhWJJgRPGCWp:wT5j6l4C6YlHcsy9NH5CaC98JujJgRPM
Malware Config
Extracted
formbook
4.1
be83
woodlandscancercare.org.uk
hosting-delightful.lol
bilpreco.com
diplomk-v-habarovske.com
dzgck.com
jsdappraisals.com
digitalnishant.com
bluevibesgift.com
wowchershoo.co.uk
eudoriaofficial.online
ourcampaign2024.net
barlogcode.com
calmingscents.biz
thewaterfallproject.africa
www-1911.com
cigapp.online
wooddroppers.africa
casmiya.com
haruminailbar.com
drivermindset.com
kittysew.com
codinformer.com
carextra247.co.uk
hackldesign.com
jollyshopping.shop
ibufalari.com
cloudcapgear.com
afro.fitness
liverightseniorcareinc.com
imetmyselfinyou.com
easy-exchange.net
crowesnestvenue.com
bigszeieveryone.com
excavatorsmachines.com
39gaokk.com
cedarcreekmartinsville.com
lcllog.com
buylikeking.com
ag1elite.com
burnoutstudio.co.uk
aldafiq.com
foxdamold.com
doanses2022.click
bellanight.net
mouhc.online
carlosarenas.online
datifybase.com
allinahealthaetna.rsvp
alanmockler.com
jeevesalarm.com
fixmaster.africa
goxoasantander.com
austinmotorvillage.net
homespreadmechanics.com
irvinedigitalrealty.com
lacigalerouge.com
bjhybaobiao.com
channamphat.com
hotelmalabarresort.com
honstarnet.com
3dseal.online
heureka-health.ch
efefwonder.buzz
migswelders.com
777584.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4732-155-0x0000000000400000-0x0000000001654000-memory.dmp formbook behavioral2/memory/4732-160-0x0000000000400000-0x0000000001654000-memory.dmp formbook behavioral2/memory/936-165-0x0000000000980000-0x00000000009AF000-memory.dmp formbook behavioral2/memory/936-167-0x0000000000980000-0x00000000009AF000-memory.dmp formbook -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
Ziraat Bankasi Swift Mesaji_pdf.exeZiraat Bankasi Swift Mesaji_pdf.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe Ziraat Bankasi Swift Mesaji_pdf.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe Ziraat Bankasi Swift Mesaji_pdf.exe -
Loads dropped DLL 1 IoCs
Processes:
Ziraat Bankasi Swift Mesaji_pdf.exepid process 4580 Ziraat Bankasi Swift Mesaji_pdf.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
Ziraat Bankasi Swift Mesaji_pdf.exepid process 4732 Ziraat Bankasi Swift Mesaji_pdf.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Ziraat Bankasi Swift Mesaji_pdf.exeZiraat Bankasi Swift Mesaji_pdf.exepid process 4580 Ziraat Bankasi Swift Mesaji_pdf.exe 4732 Ziraat Bankasi Swift Mesaji_pdf.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Ziraat Bankasi Swift Mesaji_pdf.exeZiraat Bankasi Swift Mesaji_pdf.exeipconfig.exedescription pid process target process PID 4580 set thread context of 4732 4580 Ziraat Bankasi Swift Mesaji_pdf.exe Ziraat Bankasi Swift Mesaji_pdf.exe PID 4732 set thread context of 3244 4732 Ziraat Bankasi Swift Mesaji_pdf.exe Explorer.EXE PID 936 set thread context of 3244 936 ipconfig.exe Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
Ziraat Bankasi Swift Mesaji_pdf.exedescription ioc process File opened for modification C:\Windows\Hemichordate.Ros Ziraat Bankasi Swift Mesaji_pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 936 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
Ziraat Bankasi Swift Mesaji_pdf.exeipconfig.exepid process 4732 Ziraat Bankasi Swift Mesaji_pdf.exe 4732 Ziraat Bankasi Swift Mesaji_pdf.exe 4732 Ziraat Bankasi Swift Mesaji_pdf.exe 4732 Ziraat Bankasi Swift Mesaji_pdf.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe 936 ipconfig.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3244 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Ziraat Bankasi Swift Mesaji_pdf.exeZiraat Bankasi Swift Mesaji_pdf.exeipconfig.exepid process 4580 Ziraat Bankasi Swift Mesaji_pdf.exe 4732 Ziraat Bankasi Swift Mesaji_pdf.exe 4732 Ziraat Bankasi Swift Mesaji_pdf.exe 4732 Ziraat Bankasi Swift Mesaji_pdf.exe 936 ipconfig.exe 936 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
Ziraat Bankasi Swift Mesaji_pdf.exeipconfig.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4732 Ziraat Bankasi Swift Mesaji_pdf.exe Token: SeDebugPrivilege 936 ipconfig.exe Token: SeShutdownPrivilege 3244 Explorer.EXE Token: SeCreatePagefilePrivilege 3244 Explorer.EXE Token: SeShutdownPrivilege 3244 Explorer.EXE Token: SeCreatePagefilePrivilege 3244 Explorer.EXE Token: SeShutdownPrivilege 3244 Explorer.EXE Token: SeCreatePagefilePrivilege 3244 Explorer.EXE Token: SeShutdownPrivilege 3244 Explorer.EXE Token: SeCreatePagefilePrivilege 3244 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Ziraat Bankasi Swift Mesaji_pdf.exeExplorer.EXEipconfig.exedescription pid process target process PID 4580 wrote to memory of 4732 4580 Ziraat Bankasi Swift Mesaji_pdf.exe Ziraat Bankasi Swift Mesaji_pdf.exe PID 4580 wrote to memory of 4732 4580 Ziraat Bankasi Swift Mesaji_pdf.exe Ziraat Bankasi Swift Mesaji_pdf.exe PID 4580 wrote to memory of 4732 4580 Ziraat Bankasi Swift Mesaji_pdf.exe Ziraat Bankasi Swift Mesaji_pdf.exe PID 4580 wrote to memory of 4732 4580 Ziraat Bankasi Swift Mesaji_pdf.exe Ziraat Bankasi Swift Mesaji_pdf.exe PID 3244 wrote to memory of 936 3244 Explorer.EXE ipconfig.exe PID 3244 wrote to memory of 936 3244 Explorer.EXE ipconfig.exe PID 3244 wrote to memory of 936 3244 Explorer.EXE ipconfig.exe PID 936 wrote to memory of 4404 936 ipconfig.exe cmd.exe PID 936 wrote to memory of 4404 936 ipconfig.exe cmd.exe PID 936 wrote to memory of 4404 936 ipconfig.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji_pdf.exe"2⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji_pdf.exe"3⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji_pdf.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nst6BB1.tmp\System.dllFilesize
12KB
MD5d968cb2b98b83c03a9f02dd9b8df97dc
SHA1d784c9b7a92dce58a5038beb62a48ff509e166a0
SHA256a4ec98011ef99e595912718c1a1bf1aa67bfc2192575729d42f559d01f67b95c
SHA5122ee41dc68f329a1519a8073ece7d746c9f3bf45d8ef3b915deb376af37e26074134af5f83c8af0fe0ab227f0d1acca9f37e5ca7ae37c46c3bcc0331fe5e2b97e
-
C:\Users\Admin\AppData\Roaming\DORME.iniFilesize
31B
MD53000f7f0f12b7139ea28160c52098e25
SHA19d032395f38d341881019b996e591160d542054b
SHA256467b09ff26622746d205628ae325ec9838461bc5fe741b3757bb39ddec87ecb1
SHA512a76a2f1e3686e2ffd03388ec7dbcd4afa6ae53ccd3aa40c6fbbf0c994eee5e2685d0c412f15ec4506c1175f5a84712e1a8b7ae32e6a0327e1ba47321a59e0ee2
-
memory/936-161-0x0000000000580000-0x000000000058B000-memory.dmpFilesize
44KB
-
memory/936-170-0x0000000001150000-0x00000000011E3000-memory.dmpFilesize
588KB
-
memory/936-167-0x0000000000980000-0x00000000009AF000-memory.dmpFilesize
188KB
-
memory/936-166-0x0000000001310000-0x000000000165A000-memory.dmpFilesize
3.3MB
-
memory/936-165-0x0000000000980000-0x00000000009AF000-memory.dmpFilesize
188KB
-
memory/936-163-0x0000000000580000-0x000000000058B000-memory.dmpFilesize
44KB
-
memory/3244-184-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-189-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-159-0x0000000003110000-0x0000000003215000-memory.dmpFilesize
1.0MB
-
memory/3244-219-0x0000000003250000-0x0000000003260000-memory.dmpFilesize
64KB
-
memory/3244-218-0x0000000003250000-0x0000000003260000-memory.dmpFilesize
64KB
-
memory/3244-217-0x0000000003250000-0x0000000003260000-memory.dmpFilesize
64KB
-
memory/3244-216-0x0000000002C70000-0x0000000002C80000-memory.dmpFilesize
64KB
-
memory/3244-169-0x0000000003110000-0x0000000003215000-memory.dmpFilesize
1.0MB
-
memory/3244-214-0x0000000003250000-0x0000000003260000-memory.dmpFilesize
64KB
-
memory/3244-171-0x0000000008860000-0x0000000008905000-memory.dmpFilesize
660KB
-
memory/3244-172-0x0000000008860000-0x0000000008905000-memory.dmpFilesize
660KB
-
memory/3244-173-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-174-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-176-0x0000000003220000-0x0000000003230000-memory.dmpFilesize
64KB
-
memory/3244-175-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-177-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-178-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-179-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-180-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-181-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-182-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-183-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-213-0x0000000003250000-0x0000000003260000-memory.dmpFilesize
64KB
-
memory/3244-185-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-186-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-187-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-188-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-212-0x0000000002C70000-0x0000000002C80000-memory.dmpFilesize
64KB
-
memory/3244-190-0x0000000003240000-0x000000000324B000-memory.dmpFilesize
44KB
-
memory/3244-192-0x0000000008860000-0x0000000008905000-memory.dmpFilesize
660KB
-
memory/3244-193-0x0000000003240000-0x000000000324B000-memory.dmpFilesize
44KB
-
memory/3244-195-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-196-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-197-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-198-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-199-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-200-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-201-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-202-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-203-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-204-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-205-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-206-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-207-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-208-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-209-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/3244-210-0x0000000002C80000-0x0000000002C90000-memory.dmpFilesize
64KB
-
memory/4732-160-0x0000000000400000-0x0000000001654000-memory.dmpFilesize
18.3MB
-
memory/4732-154-0x0000000000400000-0x0000000001654000-memory.dmpFilesize
18.3MB
-
memory/4732-155-0x0000000000400000-0x0000000001654000-memory.dmpFilesize
18.3MB
-
memory/4732-156-0x0000000001660000-0x00000000065E5000-memory.dmpFilesize
79.5MB
-
memory/4732-157-0x00000000369C0000-0x0000000036D0A000-memory.dmpFilesize
3.3MB
-
memory/4732-158-0x00000000000D0000-0x00000000000E4000-memory.dmpFilesize
80KB
-
memory/4732-162-0x0000000001660000-0x00000000065E5000-memory.dmpFilesize
79.5MB