Loading ...

Play interactive tourEdit tour

Windows Analysis Report Ziraat Bankasi Swift Mesaji.exe

Overview

General Information

Sample Name:Ziraat Bankasi Swift Mesaji.exe
Analysis ID:553163
MD5:161523651320083122d05dd374c87ec4
SHA1:df8fae3ff1125841de5aa2306de3501e8204919a
SHA256:f4d91c834da24d653fef9049355102bcb68be411280268af61ac8f59bce581db
Tags:AgentTeslaexegeoTURZiraatBank
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Detected unpacking (creates a PE file in dynamic memory)
Tries to steal Mail credentials (via file / registry access)
Tries to harvest and steal ftp login credentials
Machine Learning detection for sample
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Injects a PE file into a foreign processes
.NET source code contains very large array initializations
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Drops PE files
Contains functionality to read the PEB
Detected TCP or UDP traffic on non-standard ports
Uses SMTP (mail sending)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

Process Tree

  • System is w10x64
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "fizikokimya@antimikrop.com.tr", "Password": "fiziko2016Kimya", "Host": "mail.antimikrop.com.tr"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000003.00000002.554087278.00000000037F1000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000003.00000002.554087278.00000000037F1000.00000004.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      00000003.00000002.551571985.0000000000508000.00000004.00000020.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000003.00000002.551571985.0000000000508000.00000004.00000020.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
          00000003.00000000.292334595.0000000000414000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 18 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            3.2.Ziraat Bankasi Swift Mesaji.exe.37f3258.3.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              3.2.Ziraat Bankasi Swift Mesaji.exe.37f3258.3.raw.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                3.1.Ziraat Bankasi Swift Mesaji.exe.415058.1.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  3.1.Ziraat Bankasi Swift Mesaji.exe.415058.1.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    3.2.Ziraat Bankasi Swift Mesaji.exe.415058.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 55 entries

                      Sigma Overview

                      No Sigma rule has matched

                      Jbx Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 3.1.Ziraat Bankasi Swift Mesaji.exe.415058.1.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "fizikokimya@antimikrop.com.tr", "Password": "fiziko2016Kimya", "Host": "mail.antimikrop.com.tr"}
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: Ziraat Bankasi Swift Mesaji.exeReversingLabs: Detection: 23%
                      Machine Learning detection for sampleShow sources
                      Source: Ziraat Bankasi Swift Mesaji.exeJoe Sandbox ML: detected
                      Source: 3.0.Ziraat Bankasi Swift Mesaji.exe.400000.6.unpackAvira: Label: TR/Spy.Gen8
                      Source: 3.1.Ziraat Bankasi Swift Mesaji.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: 3.2.Ziraat Bankasi Swift Mesaji.exe.400000.1.unpackAvira: Label: TR/Spy.Gen8
                      Source: 3.0.Ziraat Bankasi Swift Mesaji.exe.400000.4.unpackAvira: Label: TR/Spy.Gen8
                      Source: 3.0.Ziraat Bankasi Swift Mesaji.exe.400000.5.unpackAvira: Label: TR/Spy.Gen8
                      Source: 3.0.Ziraat Bankasi Swift Mesaji.exe.400000.1.unpackAvira: Label: TR/Spy.Gen8
                      Source: 3.0.Ziraat Bankasi Swift Mesaji.exe.400000.2.unpackAvira: Label: TR/Spy.Gen8
                      Source: 3.0.Ziraat Bankasi Swift Mesaji.exe.400000.3.unpackAvira: Label: TR/Spy.Gen8
                      Source: 3.0.Ziraat Bankasi Swift Mesaji.exe.400000.8.unpackAvira: Label: TR/Spy.Gen8
                      Source: 3.2.Ziraat Bankasi Swift Mesaji.exe.4970000.5.unpackAvira: Label: TR/Spy.Gen8

                      Compliance:

                      barindex
                      Detected unpacking (creates a PE file in dynamic memory)Show sources
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeUnpacked PE file: 3.2.Ziraat Bankasi Swift Mesaji.exe.4970000.5.unpack
                      Source: Ziraat Bankasi Swift Mesaji.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dllJump to behavior
                      Source: Binary string: wntdll.pdbUGP source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000003.292591572.0000000003270000.00000004.00000001.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000000.00000003.284056753.00000000030E0000.00000004.00000001.sdmp
                      Source: Binary string: wntdll.pdb source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000003.292591572.0000000003270000.00000004.00000001.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000000.00000003.284056753.00000000030E0000.00000004.00000001.sdmp
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 0_2_00405D7C FindFirstFileA,FindClose,0_2_00405D7C
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 0_2_004053AA CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,0_2_004053AA
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 0_2_00402630 FindFirstFileA,0_2_00402630
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_00404A29 FindFirstFileExW,3_2_00404A29
                      Source: global trafficTCP traffic: 192.168.2.7:49729 -> 77.88.21.37:587
                      Source: global trafficTCP traffic: 192.168.2.7:49729 -> 77.88.21.37:587
                      Source: Ziraat Bankasi Swift Mesaji.exe, 00000003.00000002.552826458.00000000027F1000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: Ziraat Bankasi Swift Mesaji.exe, 00000003.00000002.552826458.00000000027F1000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: Ziraat Bankasi Swift Mesaji.exe, 00000003.00000002.552826458.00000000027F1000.00000004.00000001.sdmpString found in binary or memory: http://lRguGt.com
                      Source: Ziraat Bankasi Swift Mesaji.exeString found in binary or memory: http://nsis.sf.net/NSIS_Error
                      Source: Ziraat Bankasi Swift Mesaji.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
                      Source: Ziraat Bankasi Swift Mesaji.exe, 00000003.00000002.553520842.00000000029D0000.00000004.00000001.sdmpString found in binary or memory: https://Wm2Dt2zcSt3c655v3va.com
                      Source: Ziraat Bankasi Swift Mesaji.exe, 00000003.00000002.552826458.00000000027F1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%(
                      Source: Ziraat Bankasi Swift Mesaji.exe, 00000003.00000002.552826458.00000000027F1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%GETMozilla/5.0
                      Source: Ziraat Bankasi Swift Mesaji.exe, Ziraat Bankasi Swift Mesaji.exe, 00000003.00000002.554087278.00000000037F1000.00000004.00000001.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000003.00000000.292334595.0000000000414000.00000040.00000001.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000003.00000002.554248422.0000000004930000.00000004.00020000.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000003.00000001.292756258.0000000000400000.00000040.00020000.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000003.00000002.554299855.0000000004972000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: Ziraat Bankasi Swift Mesaji.exe, 00000003.00000002.552826458.00000000027F1000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
                      Source: unknownDNS traffic detected: queries for: mail.antimikrop.com.tr
                      Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.293572777.000000000074A000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 0_2_00404F61 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_00404F61

                      System Summary:

                      barindex
                      .NET source code contains very large array initializationsShow sources
                      Source: 3.2.Ziraat Bankasi Swift Mesaji.exe.4970000.5.unpack, u003cPrivateImplementationDetailsu003eu007b1374F29Cu002d8C84u002d421Cu002d89E5u002d3799DC6DC7BBu007d/u00389DEAE1Fu002dF3ECu002d4475u002dA0CFu002d11ACB2FDF936.csLarge array initialization: .cctor: array initializer size 11991
                      Source: Ziraat Bankasi Swift Mesaji.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 0_2_00403225 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,0_2_00403225
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 0_2_0040604C0_2_0040604C
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 0_2_004047720_2_00404772
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_0040A2A53_2_0040A2A5
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_008224903_2_00822490
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_008218083_2_00821808
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_00821C483_2_00821C48
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_008200703_2_00820070
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_00820BA83_2_00820BA8
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_008200143_2_00820014
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_008C56883_2_008C5688
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_008C9CE03_2_008C9CE0
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_008CD4383_2_008CD438
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_008C00703_2_008C0070
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_008CF1703_2_008CF170
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_008C00113_2_008C0011
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_049D0A903_2_049D0A90
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_049DC8E83_2_049DC8E8
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_049DD3103_2_049DD310
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_049DBB383_2_049DBB38
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_049DD2F53_2_049DD2F5
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_00A8B136 NtQuerySystemInformation,3_2_00A8B136
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_00A8B105 NtQuerySystemInformation,3_2_00A8B105
                      Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000003.285119056.00000000031F6000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Ziraat Bankasi Swift Mesaji.exe
                      Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000003.285489107.000000000338F000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Ziraat Bankasi Swift Mesaji.exe
                      Source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000002.294724890.0000000003090000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamepvCVvHYPqsReUXauAjcxcqbGhkyQCsxTXEGkQdn.exe4 vs Ziraat Bankasi Swift Mesaji.exe
                      Source: Ziraat Bankasi Swift Mesaji.exeBinary or memory string: OriginalFilename vs Ziraat Bankasi Swift Mesaji.exe
                      Source: Ziraat Bankasi Swift Mesaji.exe, 00000003.00000002.554087278.00000000037F1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamepvCVvHYPqsReUXauAjcxcqbGhkyQCsxTXEGkQdn.exe4 vs Ziraat Bankasi Swift Mesaji.exe
                      Source: Ziraat Bankasi Swift Mesaji.exe, 00000003.00000000.292334595.0000000000414000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamepvCVvHYPqsReUXauAjcxcqbGhkyQCsxTXEGkQdn.exe4 vs Ziraat Bankasi Swift Mesaji.exe
                      Source: Ziraat Bankasi Swift Mesaji.exe, 00000003.00000002.554248422.0000000004930000.00000004.00020000.sdmpBinary or memory string: OriginalFilenamepvCVvHYPqsReUXauAjcxcqbGhkyQCsxTXEGkQdn.exe4 vs Ziraat Bankasi Swift Mesaji.exe
                      Source: Ziraat Bankasi Swift Mesaji.exe, 00000003.00000001.292756258.0000000000400000.00000040.00020000.sdmpBinary or memory string: OriginalFilenamepvCVvHYPqsReUXauAjcxcqbGhkyQCsxTXEGkQdn.exe4 vs Ziraat Bankasi Swift Mesaji.exe
                      Source: Ziraat Bankasi Swift Mesaji.exe, 00000003.00000002.554299855.0000000004972000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamepvCVvHYPqsReUXauAjcxcqbGhkyQCsxTXEGkQdn.exe4 vs Ziraat Bankasi Swift Mesaji.exe
                      Source: Ziraat Bankasi Swift Mesaji.exeReversingLabs: Detection: 23%
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeFile read: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeJump to behavior
                      Source: Ziraat Bankasi Swift Mesaji.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe "C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe"
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess created: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe "C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe"
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess created: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe "C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe" Jump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_00A8AFBA AdjustTokenPrivileges,3_2_00A8AFBA
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_00A8AF83 AdjustTokenPrivileges,3_2_00A8AF83
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeFile created: C:\Users\user~1\AppData\Local\Temp\nsdADF5.tmpJump to behavior
                      Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/4@9/1
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 0_2_00402012 CoCreateInstance,MultiByteToWideChar,0_2_00402012
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeFile read: C:\Users\desktop.iniJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 0_2_00404275 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,0_2_00404275
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlpJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlpJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_00401489 GetModuleHandleW,GetModuleHandleW,FindResourceW,GetModuleHandleW,LoadResource,LockResource,GetModuleHandleW,SizeofResource,FreeResource,ExitProcess,3_2_00401489
                      Source: 3.2.Ziraat Bankasi Swift Mesaji.exe.4970000.5.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 3.2.Ziraat Bankasi Swift Mesaji.exe.4970000.5.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dllJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dllJump to behavior
                      Source: Binary string: wntdll.pdbUGP source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000003.292591572.0000000003270000.00000004.00000001.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000000.00000003.284056753.00000000030E0000.00000004.00000001.sdmp
                      Source: Binary string: wntdll.pdb source: Ziraat Bankasi Swift Mesaji.exe, 00000000.00000003.292591572.0000000003270000.00000004.00000001.sdmp, Ziraat Bankasi Swift Mesaji.exe, 00000000.00000003.284056753.00000000030E0000.00000004.00000001.sdmp

                      Data Obfuscation:

                      barindex
                      Detected unpacking (creates a PE file in dynamic memory)Show sources
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeUnpacked PE file: 3.2.Ziraat Bankasi Swift Mesaji.exe.4970000.5.unpack
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 0_2_72C51000 push eax; ret 0_2_72C5102E
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_00401F16 push ecx; ret 3_2_00401F29
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 0_2_00405DA3 GetModuleHandleA,LoadLibraryA,GetProcAddress,0_2_00405DA3
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeFile created: C:\Users\user\AppData\Local\Temp\nsyAE26.tmp\tkqqg.dllJump to dropped file
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion:

                      barindex
                      Found evasive API chain (trying to detect sleep duration tampering with parallel thread)Show sources
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeFunction Chain: threadResumed,threadDelayed,memAlloc,memAlloc,systemQueried,systemQueried,threadCreated,threadResumed,threadDelayed,threadDelayed,threadDelayed,systemQueried,systemQueried,threadDelayed,threadDelayed,threadDelayed,threadDelayed,systemQueried,threadDelayed,systemQueried,threadAPCQueued,threadDelayed,threadDelayed,threadDelayed,systemQueried
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeFunction Chain: systemQueried,threadCreated,threadResumed,threadDelayed,threadDelayed,threadDelayed,systemQueried,systemQueried,threadDelayed,threadDelayed,threadDelayed,threadDelayed,systemQueried,threadDelayed,systemQueried,threadAPCQueued,threadDelayed,threadDelayed,threadDelayed,systemQueried,threadDelayed,threadDelayed,threadDelayed,threadDelayed,memAlloc
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe TID: 6116Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe TID: 6116Thread sleep time: -4170000s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe TID: 6116Thread sleep time: -30000s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exe TID: 6116Thread sleep time: -57562s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeLast function: Thread delayed
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeWindow / User API: threadDelayed 544Jump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 0_2_00405D7C FindFirstFileA,FindClose,0_2_00405D7C
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 0_2_004053AA CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,0_2_004053AA
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 0_2_00402630 FindFirstFileA,0_2_00402630
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeCode function: 3_2_00404A29 FindFirstFileExW,3_2_00404A29
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeThread delayed: delay time: 30000Jump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeThread delayed: delay time: 30000Jump to behavior
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeAPI call chain: ExitProcess graph end nodegraph_0-3615
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeAPI call chain: ExitProcess graph end nodegraph_0-3616
                      Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji.exeAPI call chain: ExitProcess graph end nodegraph_3-55449
                      Source: Ziraat Bankasi Swift Mesaji.exe, 00000003.00000003.4813