684b9acd2a79e7ca09e996a6f6c9788c997eef5085558939cf5b125f7c39cf56

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ZiraatTRK6575740.exe
Size

345KB
MD5

710472a8addb7f60ad0cf827edc0f51a
SHA1

6f0a0dd32734de4b5529c87d5b73001bb8a2b37f
SHA256

07901d29fd52f346dfc7af58c41499260674510d887bedb11e9a5c9a87967c85
SHA512

42b295bb466ac87d441aa7bbbe22ce49e66079dbf28e58eb9ce8fdec82a716afb719ea2c94b68edc6e891a67937a52a561a232edb093687ca0dfec77d83cc1ee
SSDEEP

6144:8DIXx1xeTIIIIIIIIIIISIIIIIIIIIIlIIIasooo7ObIIGII4Ijie2QPw2qrEY33:dVeTIIIIIIIIIIISIIIIIIIIIIlIIIlB

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 46 IoCs

pid	Process
2088	ZiraatTRK6575740.exe
2516	ZiraatTRK6575740.exe
2728	ZiraatTRK6575740.exe
2856	ZiraatTRK6575740.exe
2612	ZiraatTRK6575740.exe
2636	ZiraatTRK6575740.exe
1980	ZiraatTRK6575740.exe
1988	ZiraatTRK6575740.exe
2900	ZiraatTRK6575740.exe
1208	ZiraatTRK6575740.exe
2996	ZiraatTRK6575740.exe
2100	ZiraatTRK6575740.exe
348	ZiraatTRK6575740.exe
1288	ZiraatTRK6575740.exe
1184	ZiraatTRK6575740.exe
892	ZiraatTRK6575740.exe
352	ZiraatTRK6575740.exe
2304	ZiraatTRK6575740.exe
604	ZiraatTRK6575740.exe
1936	ZiraatTRK6575740.exe
1952	ZiraatTRK6575740.exe
2832	ZiraatTRK6575740.exe
2856	ZiraatTRK6575740.exe
2692	ZiraatTRK6575740.exe
2044	ZiraatTRK6575740.exe
2648	ZiraatTRK6575740.exe
2904	ZiraatTRK6575740.exe
2784	ZiraatTRK6575740.exe
2820	ZiraatTRK6575740.exe
2956	ZiraatTRK6575740.exe
2240	ZiraatTRK6575740.exe
1616	ZiraatTRK6575740.exe
2264	ZiraatTRK6575740.exe
1292	ZiraatTRK6575740.exe
1672	ZiraatTRK6575740.exe
1692	ZiraatTRK6575740.exe
1748	ZiraatTRK6575740.exe
840	ZiraatTRK6575740.exe
2172	ZiraatTRK6575740.exe
1676	ZiraatTRK6575740.exe
1728	ZiraatTRK6575740.exe
1956	ZiraatTRK6575740.exe
1948	ZiraatTRK6575740.exe
2516	ZiraatTRK6575740.exe
2728	ZiraatTRK6575740.exe
2756	ZiraatTRK6575740.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiraatTRK6575740.exe

Suspicious behavior: MapViewOfSection 57 IoCs

pid	Process
2088	ZiraatTRK6575740.exe
2516	ZiraatTRK6575740.exe
2728	ZiraatTRK6575740.exe
2856	ZiraatTRK6575740.exe
2612	ZiraatTRK6575740.exe
2636	ZiraatTRK6575740.exe
1980	ZiraatTRK6575740.exe
1988	ZiraatTRK6575740.exe
1988	ZiraatTRK6575740.exe
2900	ZiraatTRK6575740.exe
1208	ZiraatTRK6575740.exe
2996	ZiraatTRK6575740.exe
2100	ZiraatTRK6575740.exe
2100	ZiraatTRK6575740.exe
348	ZiraatTRK6575740.exe
348	ZiraatTRK6575740.exe
1288	ZiraatTRK6575740.exe
1184	ZiraatTRK6575740.exe
892	ZiraatTRK6575740.exe
892	ZiraatTRK6575740.exe
352	ZiraatTRK6575740.exe
2304	ZiraatTRK6575740.exe
604	ZiraatTRK6575740.exe
604	ZiraatTRK6575740.exe
1936	ZiraatTRK6575740.exe
1952	ZiraatTRK6575740.exe
2832	ZiraatTRK6575740.exe
2832	ZiraatTRK6575740.exe
2856	ZiraatTRK6575740.exe
2692	ZiraatTRK6575740.exe
2044	ZiraatTRK6575740.exe
2044	ZiraatTRK6575740.exe
2648	ZiraatTRK6575740.exe
2904	ZiraatTRK6575740.exe
2784	ZiraatTRK6575740.exe
2820	ZiraatTRK6575740.exe
2956	ZiraatTRK6575740.exe
2240	ZiraatTRK6575740.exe
1616	ZiraatTRK6575740.exe
2264	ZiraatTRK6575740.exe
1292	ZiraatTRK6575740.exe
1672	ZiraatTRK6575740.exe
1692	ZiraatTRK6575740.exe
1748	ZiraatTRK6575740.exe
840	ZiraatTRK6575740.exe
840	ZiraatTRK6575740.exe
2172	ZiraatTRK6575740.exe
1676	ZiraatTRK6575740.exe
1676	ZiraatTRK6575740.exe
1728	ZiraatTRK6575740.exe
1728	ZiraatTRK6575740.exe
1956	ZiraatTRK6575740.exe
1948	ZiraatTRK6575740.exe
1948	ZiraatTRK6575740.exe
2516	ZiraatTRK6575740.exe
2728	ZiraatTRK6575740.exe
2756	ZiraatTRK6575740.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2060	2088	ZiraatTRK6575740.exe	30
PID 2088 wrote to memory of 2060	2088	ZiraatTRK6575740.exe	30
PID 2088 wrote to memory of 2060	2088	ZiraatTRK6575740.exe	30
PID 2088 wrote to memory of 2060	2088	ZiraatTRK6575740.exe	30
PID 2088 wrote to memory of 2060	2088	ZiraatTRK6575740.exe	30
PID 2088 wrote to memory of 2516	2088	ZiraatTRK6575740.exe	31
PID 2088 wrote to memory of 2516	2088	ZiraatTRK6575740.exe	31
PID 2088 wrote to memory of 2516	2088	ZiraatTRK6575740.exe	31
PID 2088 wrote to memory of 2516	2088	ZiraatTRK6575740.exe	31
PID 2516 wrote to memory of 1648	2516	ZiraatTRK6575740.exe	32
PID 2516 wrote to memory of 1648	2516	ZiraatTRK6575740.exe	32
PID 2516 wrote to memory of 1648	2516	ZiraatTRK6575740.exe	32
PID 2516 wrote to memory of 1648	2516	ZiraatTRK6575740.exe	32
PID 2516 wrote to memory of 1648	2516	ZiraatTRK6575740.exe	32
PID 2516 wrote to memory of 2728	2516	ZiraatTRK6575740.exe	34
PID 2516 wrote to memory of 2728	2516	ZiraatTRK6575740.exe	34
PID 2516 wrote to memory of 2728	2516	ZiraatTRK6575740.exe	34
PID 2516 wrote to memory of 2728	2516	ZiraatTRK6575740.exe	34
PID 2728 wrote to memory of 2740	2728	ZiraatTRK6575740.exe	35
PID 2728 wrote to memory of 2740	2728	ZiraatTRK6575740.exe	35
PID 2728 wrote to memory of 2740	2728	ZiraatTRK6575740.exe	35
PID 2728 wrote to memory of 2740	2728	ZiraatTRK6575740.exe	35
PID 2728 wrote to memory of 2740	2728	ZiraatTRK6575740.exe	35
PID 2728 wrote to memory of 2856	2728	ZiraatTRK6575740.exe	36
PID 2728 wrote to memory of 2856	2728	ZiraatTRK6575740.exe	36
PID 2728 wrote to memory of 2856	2728	ZiraatTRK6575740.exe	36
PID 2728 wrote to memory of 2856	2728	ZiraatTRK6575740.exe	36
PID 2856 wrote to memory of 2620	2856	ZiraatTRK6575740.exe	37
PID 2856 wrote to memory of 2620	2856	ZiraatTRK6575740.exe	37
PID 2856 wrote to memory of 2620	2856	ZiraatTRK6575740.exe	37
PID 2856 wrote to memory of 2620	2856	ZiraatTRK6575740.exe	37
PID 2856 wrote to memory of 2620	2856	ZiraatTRK6575740.exe	37
PID 2856 wrote to memory of 2612	2856	ZiraatTRK6575740.exe	38
PID 2856 wrote to memory of 2612	2856	ZiraatTRK6575740.exe	38
PID 2856 wrote to memory of 2612	2856	ZiraatTRK6575740.exe	38
PID 2856 wrote to memory of 2612	2856	ZiraatTRK6575740.exe	38
PID 2612 wrote to memory of 2580	2612	ZiraatTRK6575740.exe	39
PID 2612 wrote to memory of 2580	2612	ZiraatTRK6575740.exe	39
PID 2612 wrote to memory of 2580	2612	ZiraatTRK6575740.exe	39
PID 2612 wrote to memory of 2580	2612	ZiraatTRK6575740.exe	39
PID 2612 wrote to memory of 2580	2612	ZiraatTRK6575740.exe	39
PID 2612 wrote to memory of 2636	2612	ZiraatTRK6575740.exe	40
PID 2612 wrote to memory of 2636	2612	ZiraatTRK6575740.exe	40
PID 2612 wrote to memory of 2636	2612	ZiraatTRK6575740.exe	40
PID 2612 wrote to memory of 2636	2612	ZiraatTRK6575740.exe	40
PID 2636 wrote to memory of 2316	2636	ZiraatTRK6575740.exe	41
PID 2636 wrote to memory of 2316	2636	ZiraatTRK6575740.exe	41
PID 2636 wrote to memory of 2316	2636	ZiraatTRK6575740.exe	41
PID 2636 wrote to memory of 2316	2636	ZiraatTRK6575740.exe	41
PID 2636 wrote to memory of 2316	2636	ZiraatTRK6575740.exe	41
PID 2636 wrote to memory of 1980	2636	ZiraatTRK6575740.exe	42
PID 2636 wrote to memory of 1980	2636	ZiraatTRK6575740.exe	42
PID 2636 wrote to memory of 1980	2636	ZiraatTRK6575740.exe	42
PID 2636 wrote to memory of 1980	2636	ZiraatTRK6575740.exe	42
PID 1980 wrote to memory of 2136	1980	ZiraatTRK6575740.exe	43
PID 1980 wrote to memory of 2136	1980	ZiraatTRK6575740.exe	43
PID 1980 wrote to memory of 2136	1980	ZiraatTRK6575740.exe	43
PID 1980 wrote to memory of 2136	1980	ZiraatTRK6575740.exe	43
PID 1980 wrote to memory of 2136	1980	ZiraatTRK6575740.exe	43
PID 1980 wrote to memory of 1988	1980	ZiraatTRK6575740.exe	44
PID 1980 wrote to memory of 1988	1980	ZiraatTRK6575740.exe	44
PID 1980 wrote to memory of 1988	1980	ZiraatTRK6575740.exe	44
PID 1980 wrote to memory of 1988	1980	ZiraatTRK6575740.exe	44
PID 1988 wrote to memory of 300	1988	ZiraatTRK6575740.exe	45

C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
"C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
  2⤵
  PID:2060
- C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
  "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
    3⤵
    PID:1648
- - C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
    "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
      4⤵
      PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
      "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2856
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        5⤵
        
        PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2612
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        6⤵
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        7⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1980
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        8⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        8⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        9⤵
        
        PID:300
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        9⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2900
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        10⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        10⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1208
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        11⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        11⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2996
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        12⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        12⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2100
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        13⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        13⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:348
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        14⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        14⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1288
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        15⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        15⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1184
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        16⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        16⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:892
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        17⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        17⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:352
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        18⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        18⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2304
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        19⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        19⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:604
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        20⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:1920
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        21⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        21⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1936
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        22⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        22⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1952
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        23⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        23⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2832
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        24⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        24⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2856
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        25⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        25⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2692
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        26⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        26⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2044
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        27⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        27⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2648
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        28⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        28⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2904
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        29⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        29⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2784
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        30⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        30⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2820
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        31⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        31⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2956
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        32⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        32⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2240
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        33⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        33⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1616
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        34⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        34⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2264
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        35⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        35⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1292
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        36⤵
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        36⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1672
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        37⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        37⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1692
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        38⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        38⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1748
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        39⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        39⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:840
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        40⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        40⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2172
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        41⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        41⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1676
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        42⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        42⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1728
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        43⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        43⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1956
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        44⤵
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        44⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1948
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        45⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        45⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2516
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        46⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        46⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2728
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        47⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        47⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2756
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ZiraatTRK6575740.exe"
        48⤵
        
        PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\h4qxszfhuelkkgnosuu4

Filesize
7KB

MD5
a9ce258e64948b25b25de88b88abbbd6

SHA1
ca1490970dd65241665193f15bea29bec22e5d90

SHA256
d0c279fc81ff1bf700d6620350d59d999a6142cb5b6a082e3fa687eb6c1aa8fc

SHA512
ad1175ec889ca632343575b5a52f1912bb230a3f67c9096cba3c5e4ccc8023b55e4c4f3954a7fb2fb6d7b5346dff927fa3f2b2d36aebcf729f0ae1aa2488585d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wihr6efe8prm5c7

Filesize
112KB

MD5
6c634fdad078189f0c5421e2a7f5dbaf

SHA1
368646223766a40b0c9644265ce7e3799c2e85a3

SHA256
5f34f0cd5dca9103ea5b8f81881ab9c835fd1f83cec0454b0d7090a831a795ae

SHA512
90049719aeed702ec520d0cbdd044a217a73aac3f8c20c460805e597441cfc3e16ce2c3a8c0839e69b01421ea57b5ac4f1d3433ebce108f42937e39736ce9287

Download Submit
\Users\Admin\AppData\Local\Temp\nstCA52.tmp\cse4roo.dll

Filesize
5KB

MD5
55ece16004aa5f4e2922619cd4550be1

SHA1
314c0edc2a812e88da96322d340919f63a392d8d

SHA256
3ce9036a2569c7c3c15061528ecf49747620d4fd3b22338694c9525c6c0e4fc3

SHA512
25cba598082fc6d7705a0c0e7de491fe156fce88308fe510d70d40c01bf458849cf9f50f190ad67ca742b2829357170978accae1d3eeb9190850d3dc4746aa24

Download Submit
memory/1920-190-0x0000000077680000-0x000000007777A000-memory.dmp

Filesize
1000KB

Download
memory/1920-191-0x0000000002900000-0x000000000354A000-memory.dmp

Filesize
12.3MB

Download
memory/2088-8-0x00000000004A0000-0x00000000004A2000-memory.dmp

Filesize
8KB

Download