Analysis
-
max time kernel
149s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-10-2024 07:02
Static task
static1
Behavioral task
behavioral1
Sample
Ziraat Bankasi Swift Mesaji,pdf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Ziraat Bankasi Swift Mesaji,pdf.exe
Resource
win10v2004-20241007-en
General
-
Target
Ziraat Bankasi Swift Mesaji,pdf.exe
-
Size
1.9MB
-
MD5
cf2904fe594a57b07865e0a5c5564802
-
SHA1
832aa9b62e1d778942a4079c9d2637e0a0e802b1
-
SHA256
7789d88b143324fb53a504a5f340d18d202b1ef21eb004badbdd7ffba4f0fa2e
-
SHA512
93bba7bcc3caff180cf1d0f7c2cc99a08ebc31eaf63988273e42a542ae155537382b2a149f53c0fc360ce3f87d31b7980f7b3edd1266683de560623a11869217
-
SSDEEP
12288:VYKE392PohWoHazJTNVpGNWw+TUiGV3z+YgSj:KK+2kETjkJ4Opz+YgSj
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7872855149:AAEZ5N2AflriII8w90vDMIlh-npPaeOdWpk/sendMessage?chat_id=5259132764
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 15 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Ziraat Bankasi Swift Mesaji,pdf.exedescription pid process target process PID 3648 set thread context of 2056 3648 Ziraat Bankasi Swift Mesaji,pdf.exe AddInProcess32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AddInProcess32.exepid process 2056 AddInProcess32.exe 2056 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AddInProcess32.exedescription pid process Token: SeDebugPrivilege 2056 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Ziraat Bankasi Swift Mesaji,pdf.exedescription pid process target process PID 3648 wrote to memory of 2056 3648 Ziraat Bankasi Swift Mesaji,pdf.exe AddInProcess32.exe PID 3648 wrote to memory of 2056 3648 Ziraat Bankasi Swift Mesaji,pdf.exe AddInProcess32.exe PID 3648 wrote to memory of 2056 3648 Ziraat Bankasi Swift Mesaji,pdf.exe AddInProcess32.exe PID 3648 wrote to memory of 2056 3648 Ziraat Bankasi Swift Mesaji,pdf.exe AddInProcess32.exe PID 3648 wrote to memory of 2056 3648 Ziraat Bankasi Swift Mesaji,pdf.exe AddInProcess32.exe PID 3648 wrote to memory of 2056 3648 Ziraat Bankasi Swift Mesaji,pdf.exe AddInProcess32.exe PID 3648 wrote to memory of 2056 3648 Ziraat Bankasi Swift Mesaji,pdf.exe AddInProcess32.exe PID 3648 wrote to memory of 2056 3648 Ziraat Bankasi Swift Mesaji,pdf.exe AddInProcess32.exe PID 3648 wrote to memory of 1248 3648 Ziraat Bankasi Swift Mesaji,pdf.exe AddInProcess32.exe PID 3648 wrote to memory of 1248 3648 Ziraat Bankasi Swift Mesaji,pdf.exe AddInProcess32.exe PID 3648 wrote to memory of 1248 3648 Ziraat Bankasi Swift Mesaji,pdf.exe AddInProcess32.exe -
outlook_office_path 1 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe -
outlook_win_path 1 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji,pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2056
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵PID:1248
-