30 DAYS OF FORMBOOK: DAY 7, SUNDAY 2023-06-11 - GULOADER FOR FORMBOOK "XCHU"

NOTICE:

NOTES:

 

ASSOCIATED FILES:

 

IMAGES


Shown above:  Traffic from the infection filtered in Wireshark.

 

30 DAYS OF FORMBOOK: DAY 7, SUNDAY 2023-06-11 - GULOADER FOR FORMBOOK "XCHU"

INFECTION CHAIN:

- ?? --> HTTP traffic for GuLoader EXE --> GuLoader EXE --> HTTP traffic for encrypted binary --> Formbook infection

MALWARE/ARTIFACTS:

- SHA256 hash: f52f3c64c7e5729b929919c449f9087899823470d11335c5dad97f8c19ce2679
- File size: 1,273,800 bytes
- File location: hxxp[:]//107.172.148[.]217/23/cleanmgr.exe
- File type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
- File description: GuLoader EXE for Formbook

- SHA256 hash: 7cdb988da3f3317f4055c7bb0550be06f9da47e956aa4d859876205a5789f2c2
- File size: 189,504 bytes
- File location: hxxp[:]//107.172.148[.]217/cl/zbXCSdHkU190.bin
- File type: data
- File description: encoded/encrypted data binary used by this GuLoader sample for Formbook

- SHA256 hash: 31bc183c08489098dc6d52de73cb3772019b82c0c587c7c04e4a3631a1852e87
- File size: 1,273,800 bytes
- File location: C:\Program Files (x86)\H2dupmnr\Cookieswbvl.exe
- File type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
- File description: Persistent EXE for this infection
- Note: File does not execute, giving the NSIS Error: Installer integrity check failed.

GULOADER FOR FORMBOOK PERSISTENCE:

- Windows Registry key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- Value name: IDFDODJ0OBZ
- Value type: REG_SZ
- Value Data: C:\Program Files (x86)\H2dupmnr\Cookieswbvl.exe

DATA STORED FOR EXFILTRATION TO FORMBOOK C2 SERVER:

- C:\Users\[username]\AppData\Roaming\0Q61P0A2\0Q6log.ini - 0 bytes
- C:\Users\[username]\AppData\Roaming\0Q61P0A2\0Q6logim.jpeg  (screenshot of desktop)
- C:\Users\[username]\AppData\Roaming\0Q61P0A2\0Q6logrc.ini  (Outlook Recovery)
- C:\Users\[username]\AppData\Roaming\0Q61P0A2\0Q6logrf.ini  (Firefox Recovery)
- C:\Users\[username]\AppData\Roaming\0Q61P0A2\0Q6logrg.ini  (Chrome Recovery)
- C:\Users\[username]\AppData\Roaming\0Q61P0A2\0Q6logri.ini  (Iexplore Recovery)
- C:\Users\[username]\AppData\Roaming\0Q61P0A2\0Q6logrv.ini  (__Vault Recovery)

- Note: All the above files were deleted after data exfiltation, except for first file at 0 bytes.

FORMBOOK HTTP GET AND POST REQUESTS:

- GET /xchu/?[string of alphanumeric characters with the following mixed in: = _ + and /]
- POST /xchu/

DOMAINS THAT DID NOT RESOLVE:

- DNS query for www.nadiya[.]online - no response from DNS server
- DNS query for www.ptzslk[.]xyz - no response from DNS server
- DNS query for www.ugfc[.]monster - no response from DNS server

- DNS query for www.adfoidoas[.]shop - response: No such name
- DNS query for www.axcelus[.]mobi - response: No such name
- DNS query for www.bunk7outfitters[.]com - response: No such name
- DNS query for www.castilloshowroom[.]com - response: No such name
- DNS query for www.elityou[.]com - response: No such name
- DNS query for www.frenchmattie[.]com - response: No such name
- DNS query for www.girljustdoitpodcast[.]com - response: No such name
- DNS query for www.medimediamarketing[.]com - response: No such name

DOMAINS THAT RESOLVED, BUT NO CONNECTION TO SERVER:

- port 80 - www.82163[.]xyz - TCP SYN segments only, no response or RST from server
- port 80 - www.charlievgrfminnick[.]click - TCP SYN segments only, no response or RST from server

DOMAINS USED FOR FORMBOOK GET REQUESTS:

- Note: These appear to be legitimate websites or parked domain pages. 

- www.atfbestsale[.]online
- www.barhat-dance[.]online
- www.centralcoastquotes[.]com
- www.ewardsrq[.]com
- www.fleurdelis-ksa[.]com
- www.francoishogue-rpg[.]com
- www.frontdoorproperties[.]co[.]uk
- www.grandpaswag2024[.]info
- www.hauntingmedia[.]com
- www.hieu[.]asia
- www.lightbulbfestival[.]com
- www.littlefoxgrp[.]com
- www.masterbidbox[.]com
- www.misaxoxo[.]com
- www.modi[.]codes
- www.newindianewsnetwork[.]com
- www.ntzb1[.]vip
- www.prodemtim-healthy-gums[.]com
- www.tanbuhelir[.]com
- www.texaslandline[.]com
- www.wxbaonayue[.]com
- www.wxxinglong[.]com
- www.xx7zncjthyo[.]xyz
- www.zcartoons[.]com

DOMAINS USED FOR FORMBOOK GET AND POST REQUESTS:

- Note: These appear to be legitimate websites or parked domain pages. 

- www.apihb[.]com
- www.australiaxxxhookup[.]com  **
- www.aviationsoftware[.]aero  **
- www.ideeintemporelle[.]com  **
- www.lailashawa[.]com  **
- www.meter-ooh[.]com
- www.nilhanzsa[.]net  **
- www.sharonmevans[.]com
- www.sorunsuzyayinburada9[.]shop
- www.sparrow-coffee[.]com  **
- www.tangocitymoscow[.]com  **
- www.twinmall[.]xyz  **

  ** - Full stolen data (encoded) sent through HTTP POST request.

 

Click here to return to the main page.