30 DAYS OF FORMBOOK: DAY 27, SATURDAY 2023-07-01 - "NES8"

NOTICE:

NOTES:

 

ASSOCIATED FILES:

 

30 DAYS OF FORMBOOK: DAY 27, SATURDAY 2023-07-01 - "NES8"

INFECTION CHAIN:

- Email --> attached RTF ".doc" exploiting CVE-2017-11882 --> retreives and runs Formbook EXE --> Formbook C2

NOTES:

- This infection chain uses an RTF exploiting CVE-2017-11882 to retrieve and run the Formbook EXE.
- However, in this example, I used Microsoft Edge on a Windows 10 host to retreive the Formbook EXE.

MALWARE/ARTIFACTS:

- SHA256 hash: 4ef48d1dac8579e1ae4a39655a8b17aa2f7d327af0503a2bce77065d8bd8f73c
- File size: 150,124 bytes
- File name: CUSTOMER023- PURCHASE ORDER.doc
- File type: Rich Text Format data, version 1
- File description: RTF with ".doc" file extension exploiting CVE-2017-11882 for Formbook infection

- SHA256 hash: 1898f22fac7a609e186050d787f60be2d8427ad8d24fa66f44c0ddcc17cb72d5
- File size: 330,002 bytes
- File location: hxxp[:]//ask6.awt[.]com.pk/wordpress/wp-content/mad.exe
- File type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
- File description: Windows EXE for Formbook version 4.1

- SHA256 hash: a1255a580562b9ad80015641a5da339dbe73226e7ea67e4e4fc35ae54139b7c7
- File size: 81,408 bytes
- File location: C:\Program Files (x86)\Xgz3d\autochk1bylajq8.exe
- File type: PE32 executable (GUI) Intel 80386, for MS Windows
- File description: Non-malicious file where persistent Formbook would normally be saved

PPERSISTENCE:

- Windows Registry key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- Value name: TV5XV418QZCL
- Value type: REG_SZ
- Value Data: C:\Program Files (x86)\Xgz3d\autochk1bylajq8.exe

- Note: EXE referenced in the above registry key is not Formbook

DATA STORED FOR EXFILTRATION TO FORMBOOK C2 SERVER:

- C:\Users\[username]\AppData\Roaming\6-R04OQ0\6-Rlog.ini - 0 bytes
- C:\Users\[username]\AppData\Roaming\6-R04OQ0\6-Rlogim.jpeg  (screenshot of desktop)
- C:\Users\[username]\AppData\Roaming\6-R04OQ0\6-Rlogrc.ini  (Outlook Recovery)
- C:\Users\[username]\AppData\Roaming\6-R04OQ0\6-Rlogrf.ini  (Firefox Recovery)
- C:\Users\[username]\AppData\Roaming\6-R04OQ0\6-Rlogrg.ini  (Chrome Recovery)
- C:\Users\[username]\AppData\Roaming\6-R04OQ0\6-Rlogri.ini  (Iexplore Recovery)
- C:\Users\[username]\AppData\Roaming\6-R04OQ0\6-Rlogrv.ini  (__Vault Recovery)

- Note: All the above files were deleted after data exfiltation, except for first file at 0 bytes.

FORMBOOK HTTP GET AND POST REQUESTS:

- GET /nes8/?[string of alphanumeric characters with the following mixed in: = _ + and /]
- POST /nes8/

DOMAINS THAT DID NOT RESOLVE:

- DNS query for www.huibi01[.]vip - no response from DNS server
- DNS query for www.sarodret[.]buzz - no response from DNS server
- DNS query for www.soulcommunication[.]site - no response from DNS server

- DNS query for www.s95wh[.]icu - response: No such name

- DNS query for www.dgrjzz1688[.]com - no IP returned from DNS server
- DNS query for www.kruz56[.]site - no IP returned from DNS server
- DNS query for www.tbsc766[.]store - no IP returned from DNS server

DOMAINS USED FOR FORMBOOK GET REQUESTS:

- Note: These appear to be legitimate websites or parked domain pages. 

- www.adammushrooms[.]com
- www.banca-particulares[.]icu
- www.cantonbourbonroom[.]com
- www.drinkarakay[.]com
- www.incentiveexcellence[.]com
- www.jinglunqhd[.]com
- www.letterkennytown[.]com
- www.loyalguardianop[.]com
- www.marketproinv[.]info
- www.mitsubishixpander[.]com
- www.mybestfurend[.]com
- www.n7m[.]tokyo
- www.ninobrowndelivery[.]net
- www.oxylabs[.]top
- www.precisionradiologyin[.]com
- www.rainbow-bridge[.]xyz
- www.righttowrescue[.]com
- www.smartbed-gb-tok[.]life
- www.smmfsa[.]com
- www.thegoodfunguy[.]com
- www.vivre-lyon7[.]com
- www.yaxin376[.]com

DOMAINS USED FOR FORMBOOK GET AND POST REQUESTS:

- Note: These appear to be legitimate websites or parked domain pages. 

- www.abc-notation[.]com  **
- www.asmcpn[.]us
- www.culdshn[.]pics
- www.dailyhoroscope4you[.]space
- www.dietoll-official[.]site
- www.enakslot[.]net
- www.hatmam[.]com  **
- www.innovativanimal[.]com  **
- www.purityrecruitment[.]com
- www.shockgods[.]net  **
- www.sonrisasica[.]com  **
- www.swegon[.]tech
- www.wordybag[.]online  **
- www.y94x[.]info

  ** - Full stolen data (encoded) sent through HTTP POST request.

 

Click here to return to the main page.