MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d105536c7b43d74fb3c32f8179261835f52007d8fb83eb8bdf1972756156a1c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 8


Maldoc score: 15


Intelligence 8 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d105536c7b43d74fb3c32f8179261835f52007d8fb83eb8bdf1972756156a1c9
SHA3-384 hash: d5d164308799b024abd323f0aaecbf0a7c852d8b6ac7014ab45d2f35f94014d87bc004b5d0c73d3605ea949042dfa958
SHA1 hash: 329d7c5fbed4eb6b22a749d09f325ffb2bfd0082
MD5 hash: 6af9f29005392a31d7c894d51428909a
humanhash: football-paris-batman-north
File name:Payment Invoice _ Purchase Invoice Mar 2021.docm
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:43'520 bytes
First seen:2021-06-02 09:02:08 UTC
Last seen:2021-06-02 09:51:30 UTC
File type:Word file docx
MIME type:application/msword
ssdeep 384:xuhigZ7njBZgCa9IgSzrz9Ni2FcvWIE8iSwvxjk+tBEwk4L6/FWig0jd8tM:xuhZDrglSzVFcuIqxw+tyD26/FQ
TLSH 27131841B3D8C912F5120172AEC3CA9573ADBD0E6E05829B3B417F0E6D779788A3D792
Reporter abuse_ch
Tags:docm docx RemcosRAT

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 15
Application name is Microsoft Office Word
Office document is in OLE format
Office document contains VBA Macros
OLE dump

MalwareBazaar was able to identify 12 sections in this file using oledump:

Section IDSection sizeSection name
1114 bytesCompObj
24096 bytesDocumentSummaryInformation
34096 bytesSummaryInformation
47137 bytes1Table
513006 bytesData
6408 bytesMacros/PROJECT
765 bytesMacros/PROJECTwm
8936 bytesMacros/VBA/Module1
91825 bytesMacros/VBA/ThisDocument
102678 bytesMacros/VBA/_VBA_PROJECT
11571 bytesMacros/VBA/dir
124096 bytesWordDocument
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecDocument_OpenRuns when the Word or Publisher document is opened
SuspiciousshellMay run an executable file or a system command
Suspiciouswscript.shellMay run an executable file or a system command
SuspiciousRunMay run an executable file or a system command
SuspiciousCreateObjectMay create an OLE object
SuspiciousChrMay attempt to obfuscate specific strings (use option --deobf to deobfuscate)
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
SuspiciousBase64 StringsBase64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
2
# of downloads :
326
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Payment Invoice _ Purchase Invoice Mar 2021.docm
Verdict:
Malicious activity
Analysis date:
2021-06-02 09:05:48 UTC
Tags:
macros macros-on-open generated-doc
Link:
https://app.any.run/tasks/9daad2ae-cbd0-4fe9-a11a-28adc812661c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Legit
File type:
application/vnd.openxmlformats-officedocument.wordprocessingml.document
Has a screenshot:
False
Contains macros:
True
Detection(s):
TwinWave.EvilDoc.DOCXSTRGOOD..EXE.200225.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.AutoTriggerEvilMrFantasyM3.20200721.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.VB.Trojan.Valyria.4752.6993.27141.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Result
Verdict:
Malicious
File Type:
Legacy Word File with Macro
Link:
https://app.docguard.net/d105536c7b43d74fb3c32f8179261835f52007d8fb83eb8bdf1972756156a1c9/results/dashboard
Payload URLs
URL
File name
Project.Module1.structureprogram
1Table
Document image
Image:
Download PNG
Document image
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/d105536c7b43d74fb3c32f8179261835f52007d8fb83eb8bdf1972756156a1c9
Details
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
Document With Few Pages
Document contains between one and three pages of content. Most malicious documents are sparse in page count.
Macro Execution Coercion
Detected a document that appears to social engineer the user into activating embedded logic.
Macro Contains Suspicious String
Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...
InQuest Machine Learning
An InQuest machine-learning model classified this macro as potentially malicious.
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
expl.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/795731
Signature
C2 URLs / IPs found in malware configuration
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with hexadecimal encoded strings
Document exploit detected (process start blacklist hit)
Found malware configuration
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Sigma detected: Execution from Suspicious Folder
Sigma detected: Microsoft Office Product Spawning Windows Shell
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 428140 Sample: Payment Invoice _ Purchase ... Startdate: 02/06/2021 Architecture: WINDOWS Score: 100 25 cdn.discordapp.com 2->25 29 Found malware configuration 2->29 31 Malicious sample detected (through community Yara rule) 2->31 33 Multi AV Scanner detection for submitted file 2->33 35 10 other signatures 2->35 9 WINWORD.EXE 39 43 2->9         started        signatures3 process4 process5 11 powershell.exe 31 9->11         started        process6 13 significantperson.exe 19 11->13         started        17 conhost.exe 11->17         started        file7 23 C:\Users\user\AppData\Local\...\System.dll, PE32 13->23 dropped 39 Maps a DLL or memory area into another process 13->39 19 significantperson.exe 2 3 13->19         started        signatures8 process9 dnsIp10 27 172.82.128.234, 27350, 49733 QUICKPACKETUS United States 19->27 37 Installs a global keyboard hook 19->37 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d105536c7b43d74fb3c32f8179261835f52007d8fb83eb8bdf1972756156a1c9/
Threat name:
Script.Trojan.Valyria
Create hunting rule
Status:
Malicious
First seen:
2021-06-02 09:03:09 UTC
AV detection:
13 of 46 (28.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2ecvg3d3iplu7m6df6axsjqygx2sab6y7ob6xc67dfzhkykwuheq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
macro macro_on_action xlm
Link:
https://tria.ge/reports/210602-wly5f4c9p2/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Office loads VBA resources, possible macro or embedded object present
Drops file in Windows directory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d105536c7b43d74fb3c32f8179261835f52007d8fb83eb8bdf1972756156a1c9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dsc
Create hunting rule
Author:Aaron DeVera
Description:Discord domains
Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples
Rule name:UAC_bypass_bin_mem
Create hunting rule
Author:James_inthe_box
Description:UAC bypass in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Word file docx d105536c7b43d74fb3c32f8179261835f52007d8fb83eb8bdf1972756156a1c9

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments