2021-09-09 Remcos IOCs

THREAT ATTRIBUTION:  REMCOS RAT

SUBJECTS OBSERVED
Remittance, ACH10035420

SENDERS OBSERVED
ruddud124@hanmail.net

MALDOC FILE HASHES
Remittance Advice.xls
8b40971ffc5730f7105f4f2dbd7b2536

INTERMEDIATE PAYLOAD URLS
http://dreamwatchevent.com/.well-known/pki-validation/Protected Client.js
http://dreamwatchevent.com/.well-known/pki-validation/Attack.jpg

INTERMEDIATE PAYLOAD FILE HASHES
The "Protected Client.js" file is renamed:
notepad.js
b2c47a2918eef35baf623e2e42c5b694

Attack.jpg
39a0d702180e9fa8847fce7e3e3f047e

REMCOS C2
freightmgmt.duckdns.org:691
https://194.5.98.207:691

SUPPORTING EVIDENCE
https://app.any.run/tasks/9ccbfe04-3dd2-4ec6-868d-67aee72367c3/