MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 786bdc138493ae90d9a94a75e3c8900684f6854219d7698a22bf81cc2c32ef7c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 786bdc138493ae90d9a94a75e3c8900684f6854219d7698a22bf81cc2c32ef7c
SHA3-384 hash: c63ca89eeff36e689e24b33ecef4605f725f09808411ff12dda35b8d5615fcaa65261dbedbb97666ea81ca22818dbfef
SHA1 hash: 4f15b170b928f75cd4a0b5ee4d14c7a38c264e57
MD5 hash: 33106af96347ba4877e96185f9293624
humanhash: william-west-neptune-high
File name:New Order.xla
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:245'248 bytes
First seen:2024-04-30 10:33:57 UTC
Last seen:2024-04-30 11:33:29 UTC
File type:Excel file xlsx
MIME type:application/vnd.ms-excel
ssdeep 6144:Vd4UcLe0JOqPQZR8MDdATCR3tSv0W8x4tlLDL3w4Mp:wUP/qPQZR8MxAm/S8W8CnbAb
TLSH T14A340236BC30C056C82189BC78CDC5D3AF2ABDA1AE01B14F3275B36D9677168DD6129E
TrID 46.5% (.XLS) Microsoft Excel sheet (alternate) (56500/1/4)
26.7% (.XLS) Microsoft Excel sheet (32500/1/3)
20.1% (.XLS) Microsoft Excel sheet (alternate) (24500/1/2)
6.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter abuse_ch
Tags:cve-2017-0199 RemcosRAT xla xlsx

Intelligence

File Origin
# of uploads :
2
# of downloads :
411
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
786bdc138493ae90d9a94a75e3c8900684f6854219d7698a22bf81cc2c32ef7c.xlsx
Verdict:
Suspicious activity
Analysis date:
2024-04-30 10:49:35 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/45243f4f-e590-4417-8040-a88da2e4fdc0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Legit
File type:
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
Has a screenshot:
False
Contains macros:
False
Detection(s):
TwinWave.EvilDoc.93TilInfinity.20240412.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Using the Windows Management Instrumentation requests
Creating a window
DNS request
Sending an HTTP GET request
Searching for synchronization primitives
Launching a process
Сreating synchronization primitives
Creating a file
Connection attempt
Sending a custom TCP request
Creating a file in the %AppData% directory
Launching a service
Sending a UDP request
Creating a process with a hidden window
Possible injection to a system process
Connection attempt by exploiting the app vulnerability
Launching a process by exploiting the app vulnerability
Creating a process from a recently created file
Launching a file downloaded from the Internet
Result
Verdict:
Malicious
File Type:
Legacy Excel File with Macro
Link:
https://app.docguard.net/786bdc138493ae90d9a94a75e3c8900684f6854219d7698a22bf81cc2c32ef7c/results/dashboard
Payload URLs
URL
File name
http://pop.tg/E3eM2
Embedded Ole
Behaviour
BlacklistAPI detected
Document image
Image:
Download PNG
Document image
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
embedequation exploit language-tr macros masquerade shellcode
Link:
https://www.filescan.io/uploads/6630c92b54bafb7d21e7295f/reports/7aa8185f-a8e6-48ca-a08f-5ff406f31a65/overview
Verdict:
Suspicious
Labled as:
CVE-2017-0199
Link:
https://www.hybrid-analysis.com/sample/786bdc138493ae90d9a94a75e3c8900684f6854219d7698a22bf81cc2c32ef7c
Gathering data
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
spre.phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1433996
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Command shell drops VBS files
Connects to a pastebin service (likely for C&C)
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Creates autostart registry keys with suspicious values (likely registry only malware)
Delayed program exit found
Detected Remcos RAT
Document exploit detected (process start blacklist hit)
Found malware configuration
Injects a PE file into a foreign processes
Installs new ROOT certificates
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Microsoft Office drops suspicious files
Microsoft Office launches external ms-search protocol handler (WebDAV)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Office drops RTF file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Office viewer loads remote template
Searches for Windows Mail specific files
Shellcode detected
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: Equation Editor Network Connection
Sigma detected: File Dropped By EQNEDT32EXE
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powershell download and load assembly
Sigma detected: Powershell download payload from hardcoded c2 list
Sigma detected: Remcos
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Snort IDS alert for network traffic
Suspicious execution chain found
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Generic Downloader
Yara detected Powershell download and execute
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Yara detected VBS Downloader Generic
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1433996 Sample: New Order.xla.xlsx Startdate: 30/04/2024 Architecture: WINDOWS Score: 100 85 pop.tg 2->85 87 www.msftncsi.com 2->87 89 ipv6.msftncsi.com 2->89 127 Snort IDS alert for network traffic 2->127 129 Multi AV Scanner detection for domain / URL 2->129 131 Found malware configuration 2->131 133 27 other signatures 2->133 11 EXCEL.EXE 7 23 2->11         started        15 chrome.exe 4 2->15         started        18 chrome.exe 2->18         started        20 9 other processes 2->20 signatures3 process4 dnsIp5 109 pop.tg 104.21.15.201, 49163, 80 CLOUDFLARENETUS United States 11->109 111 107.175.242.96, 49164, 49168, 49191 AS-COLOCROSSINGUS United States 11->111 79 fishermansaidyouar...rethananyone[1].doc, Rich 11->79 dropped 22 wscript.exe 11 11->22         started        26 WINWORD.EXE 336 37 11->26         started        113 192.168.2.16 unknown unknown 15->113 115 192.168.2.17 unknown unknown 15->115 117 4 other IPs or domains 15->117 181 Suspicious execution chain found 15->181 29 chrome.exe 15->29         started        31 chrome.exe 18->31         started        33 chrome.exe 20->33         started        35 chrome.exe 20->35         started        37 chrome.exe 20->37         started        39 5 other processes 20->39 file6 signatures7 process8 dnsIp9 95 paste.ee 22->95 97 paste.ee 104.21.84.67, 443, 49169 CLOUDFLARENETUS United States 22->97 149 System process connects to network (likely due to code injection or exploit) 22->149 151 Suspicious powershell command line found 22->151 153 Wscript starts Powershell (via cmd or directly) 22->153 163 5 other signatures 22->163 41 powershell.exe 4 22->41         started        99 pop.tg 26->99 101 172.67.206.230, 49165, 49166, 49167 CLOUDFLARENETUS United States 26->101 71 C:\Users\user\AppData\Roaming\...\pop.tg.url, MS 26->71 dropped 73 C:\Users\user\AppData\Roaming\...3eM2.url, MS 26->73 dropped 75 ~WRF{9DDC82EA-8DE9...A-FE76190A9E3D}.tmp, Composite 26->75 dropped 77 C:\Users\user\AppData\Local\...\F1E5601C.doc, Rich 26->77 dropped 155 Microsoft Office launches external ms-search protocol handler (WebDAV) 26->155 157 Office viewer loads remote template 26->157 159 Microsoft Office drops suspicious files 26->159 44 EQNEDT32.EXE 12 26->44         started        103 www.google.com 142.250.190.132, 443, 49170, 49202 GOOGLEUS United States 29->103 105 plus.l.google.com 172.217.1.110, 443, 49190 GOOGLEUS United States 29->105 107 2 other IPs or domains 29->107 file10 161 Connects to a pastebin service (likely for C&C) 95->161 signatures11 process12 file13 165 Suspicious powershell command line found 41->165 167 Suspicious execution chain found 41->167 47 powershell.exe 13 6 41->47         started        81 C:\Users\user\...\imageofthefishermanlove.vbs, Unicode 44->81 dropped 83 C:\Users\...\imageofthefishermankiss[1].gif, Unicode 44->83 dropped 169 Office equation editor establishes network connection 44->169 171 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 44->171 signatures14 process15 dnsIp16 119 uploaddeimagens.com.br 172.67.215.45, 443, 49173, 49176 CLOUDFLARENETUS United States 47->119 121 Creates autostart registry keys with suspicious values (likely registry only malware) 47->121 123 Writes to foreign memory regions 47->123 125 Injects a PE file into a foreign processes 47->125 51 RegAsm.exe 47->51         started        55 RegAsm.exe 47->55         started        57 cmd.exe 47->57         started        60 RegAsm.exe 47->60         started        signatures17 process18 dnsIp19 91 107.172.31.178, 2404, 49192, 49193 AS-COLOCROSSINGUS United States 51->91 93 geoplugin.net 178.237.33.50, 49195, 80 ATOM86-ASATOM86NL Netherlands 51->93 135 Detected Remcos RAT 51->135 137 Maps a DLL or memory area into another process 51->137 62 RegAsm.exe 51->62         started        65 RegAsm.exe 51->65         started        67 RegAsm.exe 51->67         started        139 Contains functionality to bypass UAC (CMSTPLUA) 55->139 141 Tries to steal Mail credentials (via file registry) 55->141 143 Contains functionality to steal Chrome passwords or cookies 55->143 147 4 other signatures 55->147 69 C:\ProgramData\bismutho.vbs, ASCII 57->69 dropped 145 Command shell drops VBS files 57->145 file20 signatures21 process22 signatures23 173 Tries to steal Instant Messenger accounts or passwords 62->173 175 Tries to steal Mail credentials (via file / registry access) 62->175 177 Searches for Windows Mail specific files 62->177 179 Tries to harvest and steal browser information (history, passwords, etc) 65->179
Detection:
cve-2017-11882-shellcode
Create hunting rule
Link:
https://mwdb.cert.pl/sample/786bdc138493ae90d9a94a75e3c8900684f6854219d7698a22bf81cc2c32ef7c/
Threat name:
Document-Office.Exploit.CVE-2017-0199
Create hunting rule
Status:
Malicious
First seen:
2024-04-30 05:13:44 UTC
File Type:
Document
Extracted files:
40
AV detection:
7 of 38 (18.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pbv5ye4esoxjbwnjjj26hseqa2cpnbkcdhlwtcrcx6a4ylbs556a._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost collection persistence rat spyware stealer
Link:
https://tria.ge/reports/240430-ml4z9aaa73/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Launches Equation Editor
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Office loads VBA resources, possible macro or embedded object present
Enumerates physical storage devices
Drops file in System32 directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Adds Run key to start application
Enumerates connected drives
Abuses OpenXML format to download file from external location
Reads user/profile data of web browsers
Blocklisted process makes network request
NirSoft MailPassView
NirSoft WebBrowserPassView
Nirsoft
Remcos
Malware Config
C2 Extraction:
107.172.31.178:2404
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/786bdc138493/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/786bdc138493ae90d9a94a75e3c8900684f6854219d7698a22bf81cc2c32ef7c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:informational_win_ole_protected
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Identify OLE Project protection within documents.
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:office_document_vba
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Description:Office document with embedded VBA
Reference:https://github.com/jipegit/
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:SEH__vba
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments