#remcos_130824

#IOC #OptiData #VR #remcos #RAT #stego #pngbase64 #RegAsm #PowerShell

https://pastebin.com/VDVp6hSi

previous_contact:
19/01/24    https://pastebin.com/EvXHfZUB
18/01/24    https://pastebin.com/FL2fX362
25/12/23    https://pastebin.com/D535PVm3
21/12/23    https://pastebin.com/samYnJq6
30/11/23    https://pastebin.com/aG6XyqHN
13/11/23    https://pastebin.com/tbRpiGG5
06/02/23    https://pastebin.com/kjv5E8Au

FAQ:
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

attack_vector
--------------
email attach .xla (VBA) > get .doc (11882) > get .vbs > powershell > get base64 > get .jpeg (stego) > get .txt > decode > inject RegAsm.exe > C2


# # # # # # # #
email_headers
# # # # # # # #
Date: 13 Aug 2024 04:18:41 +0000
From: "OCBC Bank|Account Mngr (m .papolzi -ocbcbank .com)" <customercare @appaelingproduct .com>
Subject: RE: PI_PA0092000121
Received: from box0 .appaelingproduct .com ([185 .123 .102 .38])
Message-ID: <20240813041841.E40A6B787349C5B4 @appaelingproduct .com>

# # # # # # # #
files
# # # # # # # #
SHA-256		    07ff6518739dbf4f160dfe9a208aa122953ad0c5d0a10d3b05dba1b79e2ac271
File name	    PI_PA0092000121.xla
File size	    451.00 KB (461824 bytes)

SHA-256		    84f9bf00cac9b861c3088374d9031eba43506392ec66aa2ebaa9f2b1f7ad3705
File name	    wearegreattogetmebackwtihsuperattitudeleversheisverybeatygirlfrndofmysheknowthatshewanttolvoerme__________untileiloveherwithalldays.doc
File size	    104.78 KB (107298 bytes)

SHA-256		    1ffaf58260c6eb0fb2d33091a9aa48a48ea3d54e3b201b129c7b252d79e83333
File name	    shestudentgreatloverevergetme.vbS
File size	    181.19 KB (185536 bytes)

SHA-256		    ebe7c0a067c87ada62581531981365304364f4675be7cde328201395e942af9c
File name	    vbs.jpeg
File size	    1.84 MB (1929861 bytes)

SHA-256		    226c1a354cd215bd32f5f74145a2441403c71c5904150d04d0d5709030d6ee14
File name	    CAMM.txt
File size	    644.00 KB (659456 bytes)

# # # # # # # #
activity
# # # # # # # #

PL_SCR          http:// servidorwindows _ddns _com _br/Files/vbs.jpeg
                192_3_64_157 /141 /CAMM.txt

C2              192_3_101_29

netwrk
--------------
66_29_141_149		jio_cx				            443	TLSv1.3	Client Hello (SNI=jio_cx)
192_3_64_157		192_3_64_157		            80	HTTP	GET /141/ie/weare___alldays.doc HTTP/1.1 	Mozilla/4.0
192_3_64_157		192_3_64_157		            80	HTTP	HEAD /141/ie/weare___alldays.doc HTTP/1.1 	Microsoft Office Existence Discovery
192_3_64_157		192_3_64_157		            80	HTTP	GET /141/shestudentgreatloverevergetme.tIF HTTP/1.1 	Mozilla/4.0
177_106_217_75		servidorwindows _ddns _com _br		80	HTTP	GET /Files/vbs.jpeg HTTP/1.1
192_3_64_157		192_3_64_157		            80	HTTP	GET /141/CAMM.txt HTTP/1.1
192_3_101_29		14645	TLSv1.3	Client Hello

comp
--------------
EXCEL.EXE       	443     66_29_141_149
EXCEL.EXE       	443     172_64_149_23
EXCEL.EXE       	 80     104_18_38_233
EXCEL.EXE       	 80     192_3_64_157
powershell.exe	     80     177_106_217_75
powershell.exe	     80     192_3_64_157
RegAsm.exe          14645   192_3_101_29

proc
--------------
C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE
C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
	C:\Windows\System32\WScript.exe" "C:\Users\User01\AppData\Roaming\shestudentgreatloverevergetme.vBS
		C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J➹ ῎ ⺝ | ∡Bs➹ ῎ ⺝ | ∡Gk➹
			C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ...
				C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
					C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\User01\AppData\Local\Temp\dwjdeyvbtmmjfv
					C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\User01\AppData\Local\Temp\frpvwqgvhuevhbggb
					C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\User01\AppData\Local\Temp\frpvwqgvhuevhbggb
					C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\User01\AppData\Local\Temp\qtuoxjrwvcwarhuktqdh

persist
--------------
n/a

drop
--------------
C:\Users\User01\AppData\Roaming\shestudentgreatloverevergetme.vBS


# # # # # # # #
additional info
# # # # # # # #
n/a

# # # # # # # #
VT & Intezer
# # # # # # # #
https://www.virustotal.com/gui/file/07ff6518739dbf4f160dfe9a208aa122953ad0c5d0a10d3b05dba1b79e2ac271/details
https://www.virustotal.com/gui/file/84f9bf00cac9b861c3088374d9031eba43506392ec66aa2ebaa9f2b1f7ad3705/details
https://www.virustotal.com/gui/file/1ffaf58260c6eb0fb2d33091a9aa48a48ea3d54e3b201b129c7b252d79e83333/details
https://www.virustotal.com/gui/file/ebe7c0a067c87ada62581531981365304364f4675be7cde328201395e942af9c/details
https://www.virustotal.com/gui/file/226c1a354cd215bd32f5f74145a2441403c71c5904150d04d0d5709030d6ee14/details

VR