#remcos_220824

#IOC #OptiData #VR #remcos #RAT #stego #pngbase64 #PowerShell #Msbuild

https://pastebin.com/VmpVnz6b

previous_contact:
16/08/24    https://pastebin.com/AkHsxz6R
13/08/24    https://pastebin.com/VDVp6hSi
19/01/24    https://pastebin.com/EvXHfZUB
18/01/24    https://pastebin.com/FL2fX362
25/12/23    https://pastebin.com/D535PVm3
21/12/23    https://pastebin.com/samYnJq6
30/11/23    https://pastebin.com/aG6XyqHN
13/11/23    https://pastebin.com/tbRpiGG5
06/02/23    https://pastebin.com/kjv5E8Au

FAQ:
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

attack_vector
--------------
email URL > GDrive > .pdf.url > \\185 _217 _197 _84 @80\file\remittances.exe > wscript > powershell > get bitbucket .jpg & .txt > Msbuild.exe > C2


# # # # # # # #
email_headers
# # # # # # # #
Date: Thu, 22 Aug 2024 13:07:23 +0300
From: Агафонов Игорь Федорович <budi.m @tstech _co _id>
Subject: Документи (Платіжне доручення)
Reply-To: "hamed @iecinspection _com" <hamed @iecinspection _com>
Received: from svr _tstech _co _id ([116 _204 _249 _248])
Received: from [193 _33 _153 _83]

# # # # # # # #
files
# # # # # # # #
SHA-256		    2c03058661577a580eaeced9e06f918223cdecae84b91ac44a6a2755de4aff3f
File name	    scan_doc_9038376738.pdf.url
File size	    69 B (69 bytes)

SHA-256		    3e243672f6c94dd0edc7e41d6ab0920b1cd174fe102c71ae73d013c552edd6e4
File name	    new_image.jpg
File size	    4.71 MB (4942734 bytes)

SHA-256		    8770b5a446779bb6dc8eef0e4e302a68b63e07c5e79430ab80cc42b21156ffa5
File name	    gb20.txt
File size	    683.94 KB (700352 bytes)

SHA-256		    44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82
File name	    System.dll
File size	    11.00 KB (11264 bytes)

SHA-256		    910ae266eb8177aa46e2a2c77029e57b30d7aaa819c3b8451514bf1b1ae26f8d
File name	    word.exe
File size	    704.23 KB (721136 bytes)

# # # # # # # #
activity
# # # # # # # #

PL_SCR          drive _google _com/file/d/1EipxNQZfEMcr0D0v3bg9VHhhuBQfRKvK      [decoy]
                \\185 _217 _197 _84 @80\file\remittances.exe                     [dropper]
                bitbucket _org/hgdfhdfgd/test/downloads/new_image.jpg?11811735   [loader]
                bitbucket _org/hgdfhdfgd/test/downloads/new_image.jpg?14441723   [loader]
                bitbucket _org/rulmerurk/ertertqw/downloads/gb20.txt             [payload]

C2              111 _90 _148 _123


netwrk
--------------
185 _217 _197 _84	185 _217 _197 _84	80	HTTP	PROPFIND /file/remittances.exe                  HTTP/1.1 	Microsoft-WebDAV-MiniRedir/10.0.22631
185 _217 _197 _84	185 _217 _197 _84	80	HTTP	GET /file/remittances.exe                       HTTP/1.1 	Microsoft-WebDAV-MiniRedir/10.0.22631
185 _217 _197 _84	185 _217 _197 _84	80	HTTP	PROPFIND /SystemResources/remittances.exe.mun   HTTP/1.1 	Microsoft-WebDAV-MiniRedir/10.0.22631
185 _166 _143 _49	                    443	TLSv1.2	Client Hello (SNI=bitbucket _org)
3 _5 _22 _187		                    443	TLSv1.2	Client Hello (SNI=bbuseruploads.s3.amazonaws.com)
111 _90 _148 _123	2404	TCP
178 _237 _33 _50	geoplugin _net	    80	HTTP	GET /json.gp HTTP/1.1

comp
--------------
svchost.exe     185 _217 _197 _84  80
powershell.exe  185 _166 _143 _49  443
powershell.exe  3 _5 _22 _187      443
Msbuild.exe     111 _90 _148 _123  2404
Msbuild.exe     178 _237 _33 _50   80

proc
--------------
UNC\185 _217 _197 _84 @80\file\remittances.exe
    C:\Windows\SYSTEM32\cmd.exe /c plk.vbs
        C:\Windows\System32\WScript.exe "C:\Windows\System32\WScript.exe" "C:\Users\User01\AppData\Local\Temp\IXP000.TMP\plk.vbs"
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = ... base64
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" get bitbucket _org/hgdfhdfgd/test/downloads/new_image.jpg?11811735 <<BASE64_START>> ...
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
                        C:\Users\User01\AppData\Local\Temp\word.exe

persist
--------------
n/a

drop
--------------
%temp%\nsp****.tmp\System.dll
%temp%\word.exe
\ProgramData\remcos\logs.dat

# # # # # # # #
additional info
# # # # # # # #
n/a


# # # # # # # #
VT & Intezer
# # # # # # # #
https://www.virustotal.com/gui/file/2c03058661577a580eaeced9e06f918223cdecae84b91ac44a6a2755de4aff3f/details
https://www.virustotal.com/gui/file/3e243672f6c94dd0edc7e41d6ab0920b1cd174fe102c71ae73d013c552edd6e4/details
https://www.virustotal.com/gui/file/8770b5a446779bb6dc8eef0e4e302a68b63e07c5e79430ab80cc42b21156ffa5/details
https://www.virustotal.com/gui/file/44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82/details
https://www.virustotal.com/gui/file/910ae266eb8177aa46e2a2c77029e57b30d7aaa819c3b8451514bf1b1ae26f8d/details

VR