Analysis
-
max time kernel
145s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
23-10-2024 07:06
Static task
static1
Behavioral task
behavioral1
Sample
ZiraatBankasiSwiftMesajipdf.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ZiraatBankasiSwiftMesajipdf.exe
Resource
win10v2004-20241007-en
General
-
Target
ZiraatBankasiSwiftMesajipdf.exe
-
Size
1.9MB
-
MD5
cf2904fe594a57b07865e0a5c5564802
-
SHA1
832aa9b62e1d778942a4079c9d2637e0a0e802b1
-
SHA256
7789d88b143324fb53a504a5f340d18d202b1ef21eb004badbdd7ffba4f0fa2e
-
SHA512
93bba7bcc3caff180cf1d0f7c2cc99a08ebc31eaf63988273e42a542ae155537382b2a149f53c0fc360ce3f87d31b7980f7b3edd1266683de560623a11869217
-
SSDEEP
12288:VYKE392PohWoHazJTNVpGNWw+TUiGV3z+YgSj:KK+2kETjkJ4Opz+YgSj
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7872855149:AAEZ5N2AflriII8w90vDMIlh-npPaeOdWpk/sendMessage?chat_id=5259132764
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
regsvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 regsvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 regsvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 regsvcs.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ZiraatBankasiSwiftMesajipdf.exedescription pid process target process PID 2500 set thread context of 2420 2500 ZiraatBankasiSwiftMesajipdf.exe regsvcs.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
regsvcs.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvcs.exepid process 2420 regsvcs.exe 2420 regsvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
regsvcs.exedescription pid process Token: SeDebugPrivilege 2420 regsvcs.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
ZiraatBankasiSwiftMesajipdf.exedescription pid process target process PID 2500 wrote to memory of 2464 2500 ZiraatBankasiSwiftMesajipdf.exe msbuild.exe PID 2500 wrote to memory of 2464 2500 ZiraatBankasiSwiftMesajipdf.exe msbuild.exe PID 2500 wrote to memory of 2464 2500 ZiraatBankasiSwiftMesajipdf.exe msbuild.exe PID 2500 wrote to memory of 2464 2500 ZiraatBankasiSwiftMesajipdf.exe msbuild.exe PID 2500 wrote to memory of 2464 2500 ZiraatBankasiSwiftMesajipdf.exe msbuild.exe PID 2500 wrote to memory of 2464 2500 ZiraatBankasiSwiftMesajipdf.exe msbuild.exe PID 2500 wrote to memory of 2464 2500 ZiraatBankasiSwiftMesajipdf.exe msbuild.exe PID 2500 wrote to memory of 2464 2500 ZiraatBankasiSwiftMesajipdf.exe msbuild.exe PID 2500 wrote to memory of 2420 2500 ZiraatBankasiSwiftMesajipdf.exe regsvcs.exe PID 2500 wrote to memory of 2420 2500 ZiraatBankasiSwiftMesajipdf.exe regsvcs.exe PID 2500 wrote to memory of 2420 2500 ZiraatBankasiSwiftMesajipdf.exe regsvcs.exe PID 2500 wrote to memory of 2420 2500 ZiraatBankasiSwiftMesajipdf.exe regsvcs.exe PID 2500 wrote to memory of 2420 2500 ZiraatBankasiSwiftMesajipdf.exe regsvcs.exe PID 2500 wrote to memory of 2420 2500 ZiraatBankasiSwiftMesajipdf.exe regsvcs.exe PID 2500 wrote to memory of 2420 2500 ZiraatBankasiSwiftMesajipdf.exe regsvcs.exe PID 2500 wrote to memory of 2420 2500 ZiraatBankasiSwiftMesajipdf.exe regsvcs.exe PID 2500 wrote to memory of 2420 2500 ZiraatBankasiSwiftMesajipdf.exe regsvcs.exe PID 2500 wrote to memory of 2420 2500 ZiraatBankasiSwiftMesajipdf.exe regsvcs.exe PID 2500 wrote to memory of 2420 2500 ZiraatBankasiSwiftMesajipdf.exe regsvcs.exe PID 2500 wrote to memory of 2420 2500 ZiraatBankasiSwiftMesajipdf.exe regsvcs.exe PID 2500 wrote to memory of 2068 2500 ZiraatBankasiSwiftMesajipdf.exe regsvcs.exe PID 2500 wrote to memory of 2068 2500 ZiraatBankasiSwiftMesajipdf.exe regsvcs.exe PID 2500 wrote to memory of 2068 2500 ZiraatBankasiSwiftMesajipdf.exe regsvcs.exe PID 2500 wrote to memory of 2068 2500 ZiraatBankasiSwiftMesajipdf.exe regsvcs.exe PID 2500 wrote to memory of 2068 2500 ZiraatBankasiSwiftMesajipdf.exe regsvcs.exe PID 2500 wrote to memory of 2068 2500 ZiraatBankasiSwiftMesajipdf.exe regsvcs.exe PID 2500 wrote to memory of 2068 2500 ZiraatBankasiSwiftMesajipdf.exe regsvcs.exe -
outlook_office_path 1 IoCs
Processes:
regsvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 regsvcs.exe -
outlook_win_path 1 IoCs
Processes:
regsvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 regsvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZiraatBankasiSwiftMesajipdf.exe"C:\Users\Admin\AppData\Local\Temp\ZiraatBankasiSwiftMesajipdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"2⤵PID:2464
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2420
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"2⤵PID:2068
-