fbf1e50a03434dc9800dbd8f24a9e2cc5e623138c487b69560b0251b58f04ad9

Analysis

max time kernel
93s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2024 04:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe
Size

2.2MB
MD5

fa7dcecb3c5ac81610c93c6b91cda38a
SHA1

7359e8d92749a87655654a04671239dc7f300af9
SHA256

3ca1c11c2d4173581e8007b955c912dd1d6abdb1bafe03924aca8cba437df745
SHA512

da4d80a539618067918fbd81ebcb14ededcb8b90eb07aabfcab018702336ffeb8d6677f21e56ea7ae3671a0ace57b7c660efc50a659227ef7ad0f268d61d5bc9
SSDEEP

49152:5Vg5tQ7a/K+TKq8mFmM1I3Dxei0IqfDX40EaY8A5:Hg56lWF31I3D4i0vfDX40E

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

Processes:

spadixes.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spadixes.vbs	spadixes.exe

Executes dropped EXE 1 IoCs

Processes:

spadixes.exe

pid	Process
3800	spadixes.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/files/0x000a000000023b96-11.dat	autoit_exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2608	3800	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exespadixes.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spadixes.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exespadixes.exe

pid	Process
4540	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe
4540	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe
3800	spadixes.exe
3800	spadixes.exe

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exespadixes.exe

pid	Process
4540	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe
4540	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe
3800	spadixes.exe
3800	spadixes.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exespadixes.exe

description	pid	Process	procid_target
PID 4540 wrote to memory of 3800	4540	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe	83
PID 4540 wrote to memory of 3800	4540	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe	83
PID 4540 wrote to memory of 3800	4540	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe	83
PID 3800 wrote to memory of 1040	3800	spadixes.exe	84
PID 3800 wrote to memory of 1040	3800	spadixes.exe	84
PID 3800 wrote to memory of 1040	3800	spadixes.exe	84

C:\Users\Admin\AppData\Local\Temp\Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe
"C:\Users\Admin\AppData\Local\Temp\Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Users\Admin\AppData\Local\bothsided\spadixes.exe
  "C:\Users\Admin\AppData\Local\Temp\Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe"
    3⤵
    PID:1040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 756
    3⤵
    - Program crash
    PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3800 -ip 3800
1⤵
PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut7927.tmp

Filesize
1.3MB

MD5
8064e730487a7492200f210d929c8423

SHA1
65c892be84c7b59da335981e8b86ce5a53b40b6d

SHA256
1fb3121de3f8678b0f619cc88798a4c82bf240a3a8819829ac0e7d8f9d779549

SHA512
a16d8d08ad3acc371380e63d2748f268c02b0dd007dc77e0e85b3cb8a93486c47bc4046a11ef609b17528b83c1b0aa6f6881decec13dfeeecd0b9e7bd3ec4824

Download Submit
C:\Users\Admin\AppData\Local\bothsided\spadixes.exe

Filesize
2.2MB

MD5
fa7dcecb3c5ac81610c93c6b91cda38a

SHA1
7359e8d92749a87655654a04671239dc7f300af9

SHA256
3ca1c11c2d4173581e8007b955c912dd1d6abdb1bafe03924aca8cba437df745

SHA512
da4d80a539618067918fbd81ebcb14ededcb8b90eb07aabfcab018702336ffeb8d6677f21e56ea7ae3671a0ace57b7c660efc50a659227ef7ad0f268d61d5bc9

Download Submit
memory/3800-22-0x00000000010A0000-0x00000000014A0000-memory.dmp

Filesize
4.0MB

Download
memory/4540-8-0x0000000001030000-0x0000000001430000-memory.dmp

Filesize
4.0MB

Download