30 DAYS OF FORMBOOK: DAY 24, WEDNESDAY 2023-06-28 - "RX63"

NOTICE:

NOTES:

 

ASSOCIATED FILES:

 

IMAGES


Shown above:  Screenshot of email distributing Formbook.

 


Shown above:  Formbook EXE in the RAR arhive.

 


Shown above:  Traffic from the infection filtered in Wireshark.

 


Shown above:  Formbook persistent on the infected Windows host.

 

30 DAYS OF FORMBOOK: DAY 24, WEDNESDAY 2023-06-28 - "RX63"

INFECTION CHAIN:

- Email --> attached RAR archive --> extracted Formbook EXE --> victim runs Formbook EXE

MALWARE/ARTIFACTS:

- SHA256 hash: 9eeb0e4740e10819a0d2ecf0a3c7dd93d7ec6348106366f8fff268746aea00e8
- File size: 228,534 bytes
- File name: RFx - NRSB-SPCI_QHK_NRSB_SPCI_115R1_023.txz
- File type: RAR archive data, v5
- File description: RAR archive containing Formbook EXE

- SHA256 hash: 011765b154e93fd26afc6331fa7330996162cd8b9ae00c938a630e6bcca2cc0f
- File size: 244,469 bytes
- File name: RFx - NRSB-SPCI_QHK_NRSB_SPCI_115R1_023.exe
- Persistent file location: C:\Program Files (x86)\Jprn056\ihfhlpp_.exe
- File type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
- File description: Windows EXE for Formbook version 4.1

PERSISTENCE:

- Windows Registry key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- Value name: IHG4R6NHB4
- Value type: REG_SZ
- Value Data: C:\Program Files (x86)\Jprn056\ihfhlpp_.exe

DATA STORED FOR EXFILTRATION TO FORMBOOK C2 SERVER:

- C:\Users\[username]\AppData\Roaming\609130U8\609log.ini - 0 bytes
- C:\Users\[username]\AppData\Roaming\609130U8\609logim.jpeg  (screenshot of desktop)
- C:\Users\[username]\AppData\Roaming\609130U8\609logrc.ini  (Outlook Recovery)
- C:\Users\[username]\AppData\Roaming\609130U8\609logrf.ini  (Firefox Recovery)
- C:\Users\[username]\AppData\Roaming\609130U8\609logrg.ini  (Chrome Recovery)
- C:\Users\[username]\AppData\Roaming\609130U8\609logri.ini  (Iexplore Recovery)
- C:\Users\[username]\AppData\Roaming\609130U8\609logrv.ini  (__Vault Recovery)

- Note: All the above files were deleted after data exfiltation, except for first file at 0 bytes.

FORMBOOK HTTP GET AND POST REQUESTS:

- GET /rx63/?[string of alphanumeric characters with the following mixed in: = _ + and /]
- POST /rx63/

DOMAINS THAT DID NOT RESOLVE:

- DNS query for www.lavarlaropa[.]com - no response from DNS server
- DNS query for www.vapeaid[.]africa - no response from DNS server
- DNS query for www.visiogeomatics[.]africa - no response from DNS server

- DNS query for www.aaataxassistants[.]com - response: No such name
- DNS query for www.beawallhdmp4[.]com - response: No such name
- DNS query for www.begladgardens[.]com - response: No such name
- DNS query for www.bmg[.]social - response: No such name
- DNS query for www.dotnetfashions[.]com - response: No such name
- DNS query for www.efefcause[.]buzz - response: No such name
- DNS query for www.elegantshopee[.]com - response: No such name
- DNS query for www.prepandgo[.]net - response: No such name

- DNS query for www.odinzsky[.]net - no IP returned from DNS server

DOMAINS THAT RESOLVED, BUT NO CONNECTION TO SERVER:

-  port 80 - www.25736[.]football - TCP SYN segments only, no response or RST from server

DOMAINS USED FOR FORMBOOK GET REQUESTS:

- Note: These appear to be legitimate websites or parked domain pages. 

- www.1wnvdb[.]top
- www.4everlovinpets[.]com
- www.7s5ghbwdmjt[.]cfd
- www.ailawesquire[.]com
- www.amazing-cajun[.]com
- www.aretealternatives[.]com
- www.beesleyandco[.]com
- www.biographtheater[.]com
- www.bitprice[.]cash
- www.brainstormbotanics[.]com
- www.caakapp[.]buzz
- www.cadomarketing[.]com
- www.capitalspatial[.]com
- www.chinacya[.]com
- www.covenantchurchag[.]com
- www.groomersfirstchoice[.]com
- www.kitchenpharmacy[.]co[.]uk
- www.kosmetik19[.]space
- www.laurellawncare[.]com
- www.like-clinic[.]ru
- www.nnkkd[.]com
- www.wxvaillant[.]com

DOMAINS USED FOR FORMBOOK GET AND POST REQUESTS:

- Note: These appear to be legitimate websites or parked domain pages. 

- www.artecucinaitaly[.]com  **
- www.benelu-duodefils[.]com  **
- www.bipartisan[.]one
- www.birslot[.]xyz
- www.brixu[.]xyz  **
- www.cenik[.]biz
- www.dirlkit[.]online  **
- www.dollardstown[.]com  **
- www.dualio[.]tech
- www.dungeoncompanion[.]com
- www.ekidsstarvn[.]com  **
- www.houtsang[.]top
- www.hrmyy[.]com  **
- www.igusa[.]top
- www.kensklutefineart[.]com

  ** - Full stolen data (encoded) sent through HTTP POST request.

 

Click here to return to the main page.