Analysis
-
max time kernel
145s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-10-2024 07:02
Static task
static1
Behavioral task
behavioral1
Sample
Ziraat Bankasi Swift Mesaji,pdf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Ziraat Bankasi Swift Mesaji,pdf.exe
Resource
win10v2004-20241007-en
General
-
Target
Ziraat Bankasi Swift Mesaji,pdf.exe
-
Size
1.9MB
-
MD5
cf2904fe594a57b07865e0a5c5564802
-
SHA1
832aa9b62e1d778942a4079c9d2637e0a0e802b1
-
SHA256
7789d88b143324fb53a504a5f340d18d202b1ef21eb004badbdd7ffba4f0fa2e
-
SHA512
93bba7bcc3caff180cf1d0f7c2cc99a08ebc31eaf63988273e42a542ae155537382b2a149f53c0fc360ce3f87d31b7980f7b3edd1266683de560623a11869217
-
SSDEEP
12288:VYKE392PohWoHazJTNVpGNWw+TUiGV3z+YgSj:KK+2kETjkJ4Opz+YgSj
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7872855149:AAEZ5N2AflriII8w90vDMIlh-npPaeOdWpk/sendMessage?chat_id=5259132764
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
regsvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 regsvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 regsvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 regsvcs.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Ziraat Bankasi Swift Mesaji,pdf.exedescription pid process target process PID 1732 set thread context of 1720 1732 Ziraat Bankasi Swift Mesaji,pdf.exe regsvcs.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
regsvcs.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvcs.exepid process 1720 regsvcs.exe 1720 regsvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
regsvcs.exedescription pid process Token: SeDebugPrivilege 1720 regsvcs.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Ziraat Bankasi Swift Mesaji,pdf.exedescription pid process target process PID 1732 wrote to memory of 1720 1732 Ziraat Bankasi Swift Mesaji,pdf.exe regsvcs.exe PID 1732 wrote to memory of 1720 1732 Ziraat Bankasi Swift Mesaji,pdf.exe regsvcs.exe PID 1732 wrote to memory of 1720 1732 Ziraat Bankasi Swift Mesaji,pdf.exe regsvcs.exe PID 1732 wrote to memory of 1720 1732 Ziraat Bankasi Swift Mesaji,pdf.exe regsvcs.exe PID 1732 wrote to memory of 1720 1732 Ziraat Bankasi Swift Mesaji,pdf.exe regsvcs.exe PID 1732 wrote to memory of 1720 1732 Ziraat Bankasi Swift Mesaji,pdf.exe regsvcs.exe PID 1732 wrote to memory of 1720 1732 Ziraat Bankasi Swift Mesaji,pdf.exe regsvcs.exe PID 1732 wrote to memory of 1720 1732 Ziraat Bankasi Swift Mesaji,pdf.exe regsvcs.exe PID 1732 wrote to memory of 1720 1732 Ziraat Bankasi Swift Mesaji,pdf.exe regsvcs.exe PID 1732 wrote to memory of 1720 1732 Ziraat Bankasi Swift Mesaji,pdf.exe regsvcs.exe PID 1732 wrote to memory of 1720 1732 Ziraat Bankasi Swift Mesaji,pdf.exe regsvcs.exe PID 1732 wrote to memory of 1720 1732 Ziraat Bankasi Swift Mesaji,pdf.exe regsvcs.exe PID 1732 wrote to memory of 1744 1732 Ziraat Bankasi Swift Mesaji,pdf.exe WerFault.exe PID 1732 wrote to memory of 1744 1732 Ziraat Bankasi Swift Mesaji,pdf.exe WerFault.exe PID 1732 wrote to memory of 1744 1732 Ziraat Bankasi Swift Mesaji,pdf.exe WerFault.exe -
outlook_office_path 1 IoCs
Processes:
regsvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 regsvcs.exe -
outlook_win_path 1 IoCs
Processes:
regsvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 regsvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji,pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1720
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1732 -s 6202⤵PID:1744
-