Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-10-2024 07:06
Static task
static1
Behavioral task
behavioral1
Sample
ZiraatBankasiSwiftMesajipdf.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ZiraatBankasiSwiftMesajipdf.exe
Resource
win10v2004-20241007-en
General
-
Target
ZiraatBankasiSwiftMesajipdf.exe
-
Size
1.9MB
-
MD5
cf2904fe594a57b07865e0a5c5564802
-
SHA1
832aa9b62e1d778942a4079c9d2637e0a0e802b1
-
SHA256
7789d88b143324fb53a504a5f340d18d202b1ef21eb004badbdd7ffba4f0fa2e
-
SHA512
93bba7bcc3caff180cf1d0f7c2cc99a08ebc31eaf63988273e42a542ae155537382b2a149f53c0fc360ce3f87d31b7980f7b3edd1266683de560623a11869217
-
SSDEEP
12288:VYKE392PohWoHazJTNVpGNWw+TUiGV3z+YgSj:KK+2kETjkJ4Opz+YgSj
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7872855149:AAEZ5N2AflriII8w90vDMIlh-npPaeOdWpk/sendMessage?chat_id=5259132764
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 22 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ZiraatBankasiSwiftMesajipdf.exedescription pid process target process PID 3908 set thread context of 4292 3908 ZiraatBankasiSwiftMesajipdf.exe AddInProcess32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AddInProcess32.exepid process 4292 AddInProcess32.exe 4292 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AddInProcess32.exedescription pid process Token: SeDebugPrivilege 4292 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
ZiraatBankasiSwiftMesajipdf.exedescription pid process target process PID 3908 wrote to memory of 4292 3908 ZiraatBankasiSwiftMesajipdf.exe AddInProcess32.exe PID 3908 wrote to memory of 4292 3908 ZiraatBankasiSwiftMesajipdf.exe AddInProcess32.exe PID 3908 wrote to memory of 4292 3908 ZiraatBankasiSwiftMesajipdf.exe AddInProcess32.exe PID 3908 wrote to memory of 4292 3908 ZiraatBankasiSwiftMesajipdf.exe AddInProcess32.exe PID 3908 wrote to memory of 4292 3908 ZiraatBankasiSwiftMesajipdf.exe AddInProcess32.exe PID 3908 wrote to memory of 4292 3908 ZiraatBankasiSwiftMesajipdf.exe AddInProcess32.exe PID 3908 wrote to memory of 4292 3908 ZiraatBankasiSwiftMesajipdf.exe AddInProcess32.exe PID 3908 wrote to memory of 4292 3908 ZiraatBankasiSwiftMesajipdf.exe AddInProcess32.exe PID 3908 wrote to memory of 2072 3908 ZiraatBankasiSwiftMesajipdf.exe AddInProcess32.exe PID 3908 wrote to memory of 2072 3908 ZiraatBankasiSwiftMesajipdf.exe AddInProcess32.exe PID 3908 wrote to memory of 2072 3908 ZiraatBankasiSwiftMesajipdf.exe AddInProcess32.exe -
outlook_office_path 1 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe -
outlook_win_path 1 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZiraatBankasiSwiftMesajipdf.exe"C:\Users\Admin\AppData\Local\Temp\ZiraatBankasiSwiftMesajipdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4292
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵PID:2072
-