Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    15-12-2024 07:55

General

  • Target

    roominglist.exe

  • Size

    355KB

  • MD5

    0a13ecd06bd1e3f0eab2f9978decb649

  • SHA1

    62a914a933c5f25d23ff72c8d1cc937d0f19c0d9

  • SHA256

    9f22499224e80938917ef48a3e490372372395cc95a66c9c6df16b64fa384b46

  • SHA512

    953309685fc31399d1e746033b519b6ef5ab736465043c79e390b0cef65af95c56891eb81496ca1170ba08ae30a883739cf359a2ed35e5979111f2fbf66ec414

  • SSDEEP

    6144:zlag31vYxBBcW7stlZ5WVplicKX1w5zBy2pp7qBR4bXOaEBej/jxzQWVwueoqziD:zlaglvYxBBZ7iZkVpwX1w59BpKR46aEW

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mn9v

Decoy

whitepqags.com

jyps95.com

lkportoes.com

discotwinks.com

samgyupontheway.info

fourtimeseight.com

fossahosting.net

siakadvm.com

mywebpromotion.com

vysocky.coffee

folkloren.com

underwier.agency

moneymatric.com

romaditalialr.com

unfilteredessence.com

viktorlevi.com

curbo.info

sacrilege.church

charlenemee.com

magatv.net

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\roominglist.exe
    "C:\Users\Admin\AppData\Local\Temp\roominglist.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Users\Admin\AppData\Local\Temp\roominglist.exe
      "C:\Users\Admin\AppData\Local\Temp\roominglist.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 36
        3⤵
        • Program crash
        PID:2752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2776-3-0x0000000000080000-0x00000000000AE000-memory.dmp

    Filesize

    184KB

  • memory/3068-2-0x0000000000100000-0x0000000000102000-memory.dmp

    Filesize

    8KB

  • memory/3068-1-0x00000000003A0000-0x00000000004A0000-memory.dmp

    Filesize

    1024KB