ANY.RUN Analysis Traces Formbook Campaign Using Localized Order Lures
Summary
ANY.RUN investigated a Formbook campaign using localized business-document lures. Its analysis details an obfuscated JavaScript and PowerShell infection chain, process hollowing, persistence, browser credential theft, and related activity.
Key points
- ANY.RUN analyzed samples submitted from the UK, Italy, the Balkans, and the South Caucasus, using localized procurement, order, quotation, and payment lures.
- An obfuscated JavaScript file launches hidden PowerShell, which uses AES-256-CBC to decrypt and execute a payload in memory.
- The .NET injector GHOST.dll uses process hollowing to run Formbook inside aspnet_compiler.exe; a watchdog attempts reinjection, and Formbook later runs in rekeywiz.exe.
- The loader creates Run-key and Startup-folder persistence using the SystemUpdate_ps_* naming pattern.
- The analyzed Formbook payload targets browser-stored credentials and communicates with C2 infrastructure over HTTP; its traffic used an Android 4.1.1 User-Agent from a Windows environment.
- ANY.RUN found the same injector in a separate analysis and overlapping artifacts in analyses involving other malware, suggesting some components or techniques may be reused.
Article Details
- Attack Vectors
- Localized procurement, purchase-order, quotation, and payment lures were delivered as malicious ZIP attachments containing JavaScript files.
- The JavaScript dropper wrote a randomly named PowerShell script to a temporary directory and launched it with hidden execution parameters.
- An AES-protected PowerShell stage decrypted and executed a payload in memory; a .NET injector used process hollowing to run Formbook inside aspnet_compiler.exe.
- The malware used registry Run keys and a Startup-folder shortcut for persistence, then communicated with C2 infrastructure over HTTP.
- Defensive Notes
- Investigate hidden PowerShell launched by wscript.exe, especially when it executes a randomly named script from C:\Temp\ or %TEMP%.
- Correlate repeated launches of aspnet_compiler.exe, unexpected Formbook activity in rekeywiz.exe, and SystemUpdate_ps_* startup or Run-key artifacts.
- Monitor for browser-database access and credential theft, plus outbound HTTP traffic using an Android 4.1.1 User-Agent from Windows hosts.
- The article recommends domain-based detection for www[.]hlushkova[.]top because one observed IP was associated with shared hosting.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | www[.]hlushkova[.]top | Domain identified in the observed Formbook C2 infrastructure. |
| DOMAIN | www[.]stanbicfinanceug[.]com | Domain identified in the observed Formbook C2 infrastructure. |
| IPV4 | 2[.]58[.]67[.]83 | IP address listed in the article's network indicators for the campaign. |
| IPV4 | 91[.]234[.]194[.]113 | IP address listed in the article's network indicators for the campaign. |
| SHA256 | 2974a808e24e76c1a9fecdaaecebefe27e841204bc1aa20536c32c1f0b309f47 | SHA-256 hash of GHOST.dll, the .NET injector used to deploy Formbook. |
| SHA256 | 45e598a8dddd7e9cc7b7e7a2f319c0e9f3f090ad4a089e50c3c9e4d75ee9d718 | SHA-256 hash of the PowerShell injector associated with the infection chain. |
| SHA256 | 4fd6430a61e5d42a452c3a7de94d03173b9eb02d06aa33357fe5ee9776524aec | SHA-256 hash of the persistence shortcut identified in the analysis. |
| SHA256 | 58eb890b612938867237c3fa1715b8742d9b25a8fe136cd75ea659882b7b7a10 | SHA-256 hash of the malicious Nova narudžba 0148-712.zip archive. |
| SHA256 | a970e997093fcd10d108354423c8fa420a6887ed97cbf7c7dbe3551faa4d9b95 | SHA-256 hash of the JavaScript file in the malicious archive. |
| SHA256 | b0ee22dee7a8a9710992294f73069f047d31506b50dc1150ef6013fcd6225ed1 | SHA-256 hash of the AES PowerShell loader used in the infection chain. |
| SHA256 | f5c9a28325ed2eab5c7d029bfed410f05ae858b6b436e3b14891f29a6ec96d73 | SHA-256 hash of the Formbook payload. |
| URL | hxxp[:]//www[.]hlushkova[.]top/ef5f/ | C2 URL listed among the indicators for the observed activity. |
| URL | hxxp[:]//www[.]stanbicfinanceug[.]com/9wgi/ | C2 URL listed among the indicators for the observed activity. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe JavaScript was heavily obfuscated, and the injector was protected with ConfuserEx.T1036.005 · Match Legitimate Resource Name or LocationThe Startup shortcut used the name SystemUpdate_ps_* and the description System Update Service.T1055.012 · Process HollowingThe .NET injector used process hollowing to execute Formbook inside aspnet_compiler.exe.T1057 · Process DiscoveryThe watchdog checked every five seconds whether the injected aspnet_compiler.exe process was running.T1059.001 · PowerShellThe dropper launched hidden PowerShell, which decrypted and executed the next stage.T1059.007 · JavaScriptA JavaScript dropper decoded a PowerShell payload and wrote it to disk.T1071.001 · Web ProtocolsThe malware communicated with its C2 infrastructure over HTTP.T1140 · Deobfuscate/Decode Files or InformationThe loader decoded Base64 resources and used AES-256-CBC to decrypt the next stage.T1204.002 · Malicious FileThe campaign's lures were designed to persuade employees to open malicious attachments.T1547.001 · Registry Run Keys / Startup FolderPersistence used Windows Run-key values and a shortcut in the Startup folder.T1555.003 · Credentials from Web BrowsersFormbook targeted browser databases to collect browser-stored credentials.T1566.001 · Spearphishing AttachmentThe malicious ZIP containing the JavaScript lure was observed as an email attachment.
Malware
Vendors
Products
Microsoft WindowsHTTP communication, suspicious domains, and an Android User-Agent sent from a Windows host can help identify the activity.Mozilla FirefoxFrom there, it launches Firefox and creates a randomly named file in %TEMP%, consistent with the collection of browser databases before reading them.PowerShellObfuscated JavaScript launches PowerShell stages, which decrypt and execute payloads in memory before deploying a .NET injector.
Tools
ANY.RUN Interactive SandboxThe Formbook attack chain observed in ANY.RUN’s Interactive SandboxConfuserExProtected with ConfuserEx, the injector uses process hollowing to execute Formbook inside the legitimate Windows process aspnet_compiler.exe.Obfuscator.ioApproximately 2 MB in size, the script is heavily obfuscated using obfuscator.io techniques.Threat Intelligence LookupA powerful new feature inside ANY.RUN’s sandbox — Related Threat Context (Related analyses) — connects with Threat Intelligence Lookup and helps SOCs and MSSPs explore connected activity beyond the original sample.