MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4177fb3986e1f8c74df732b13752ece8d3dbb2e2ea6969b0cf328fc71ebd400. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 11


Maldoc score: 13


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f4177fb3986e1f8c74df732b13752ece8d3dbb2e2ea6969b0cf328fc71ebd400
SHA3-384 hash: afc260ab46b8c7ff1eb19721a188439f7e8a020405d30ea921116b6ec21065d0ba3844e1f22edf2915f98b9cf899258d
SHA1 hash: d8a863a3df25f2dad2cad2de84f000ea586fb988
MD5 hash: 5906faf9c6f5092a70faba0e4ab48a61
humanhash: florida-lake-nuts-ink
File name:ACH Remittance.xls
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:75'264 bytes
First seen:2021-10-09 06:18:05 UTC
Last seen:2021-10-09 06:56:58 UTC
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 1536:lk3hOdsylKlgxopeiBNhZFGzE+cL2kdA3CzI0ScDNzmVQyrnHRBoESK4nceC7r9n:lk3hOdsylKlgxopeiBNhZFGzE+cL2kd0
TLSH T1B2737CA6F6C1DC06CE6A077A48F782D6662AFC551F63834F3248F75E0F71AD0891261B
Reporter abuse_ch
Tags:RemcosRAT xls

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 13
OLE dump

MalwareBazaar was able to identify 10 sections in this file using oledump:

Section IDSection sizeSection name
1108 bytesCompObj
2244 bytesDocumentSummaryInformation
3220 bytesSummaryInformation
463108 bytesWorkbook
5422 bytes_VBA_PROJECT_CUR/PROJECT
662 bytes_VBA_PROJECT_CUR/PROJECTwm
7991 bytes_VBA_PROJECT_CUR/VBA/Sheet1
82135 bytes_VBA_PROJECT_CUR/VBA/ThisWorkbook
92526 bytes_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
10520 bytes_VBA_PROJECT_CUR/VBA/dir
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecWorkbook_OpenRuns when the Excel Workbook is opened
SuspiciousOpenMay open a file
SuspiciousOutputMay write to a file (if combined with Open)
SuspiciousCreateObjectMay create an OLE object
SuspiciousChrMay attempt to obfuscate specific strings (use option --deobf to deobfuscate)
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
SuspiciousBase64 StringsBase64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
2
# of downloads :
352
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ACH Remittance.xls
Verdict:
Malicious activity
Analysis date:
2021-10-09 06:21:20 UTC
Tags:
macros macros-on-open trojan opendir loader rat remcos keylogger
Link:
https://app.any.run/tasks/1154d8ae-089c-454e-97b7-030222e38361

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/196261/
Detection(s):
TwinWave.EvilDoc.DOCXSTRGOOD.HTTP
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.START-BITSTRANSFER.210729.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.CHR_AEONONANDON.20210930.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.OdysseyAndBattle.20210707.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
Legacy Excel File with Macro
Link:
https://app.docguard.net/f4177fb3986e1f8c74df732b13752ece8d3dbb2e2ea6969b0cf328fc71ebd400/results/dashboard
Document image
Image:
Download PNG
Document image
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
80%
Tags:
macros macros-on-open
Link:
https://www.filescan.io/uploads/61613423ddf069d1b6a4e988/reports/1781f55f-b621-48ae-b772-ce6b169ea26a/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/f4177fb3986e1f8c74df732b13752ece8d3dbb2e2ea6969b0cf328fc71ebd400
Details
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
Macro with File System Write
Detected macro logic that can write data to the file system.
Macro Execution Coercion
Detected a document that appears to social engineer the user into activating embedded logic.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
expl.evad.troj
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/867366
Signature
Document exploit detected (creates forbidden files)
Document exploit detected (process start blacklist hit)
Machine Learning detection for dropped file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Sigma detected: Execution from Suspicious Folder
Sigma detected: Microsoft Office Product Spawning Windows Shell
Uses dynamic DNS services
Yara detected Obfuscated Powershell
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 499796 Sample: ACH Remittance.xls Startdate: 09/10/2021 Architecture: WINDOWS Score: 80 33 thepunchlineexpose.com 2->33 35 cartextranss.duckdns.org 2->35 39 Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) 2->39 41 Machine Learning detection for dropped file 2->41 43 Uses dynamic DNS services 2->43 45 4 other signatures 2->45 10 EXCEL.EXE 25 19 2->10         started        signatures3 process4 dnsIp5 37 192.168.2.1 unknown unknown 10->37 31 C:\Users\Public\Documents\assumeseason.cmd, ASCII 10->31 dropped 49 Document exploit detected (creates forbidden files) 10->49 15 cmd.exe 1 10->15         started        file6 signatures7 process8 process9 17 powershell.exe 25 15->17         started        19 conhost.exe 15->19         started        process10 21 writerlast.exe 1 2 17->21         started        file11 27 C:\Users\user\AppData\Roaming\taskmgr.exe, PE32 21->27 dropped 29 C:\Users\user\AppData\...\writerlast.exe, PE32 21->29 dropped 24 writerlast.exe 21->24         started        process12 signatures13 47 Machine Learning detection for dropped file 24->47
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f4177fb3986e1f8c74df732b13752ece8d3dbb2e2ea6969b0cf328fc71ebd400/
Threat name:
Document-Office.Trojan.Mragg
Create hunting rule
Status:
Malicious
First seen:
2021-10-08 23:43:40 UTC
File Type:
Document
Extracted files:
14
AV detection:
15 of 40 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6qlx7m4ynypyy5g7omvrg5joz2gt3ozof2tjngym6mupy4pl2qaa._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost macro macro_on_action persistence rat xlm
Link:
https://tria.ge/reports/211009-g27s7afae4/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Office loads VBA resources, possible macro or embedded object present
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
Process spawned unexpected child process
Remcos
Malware Config
C2 Extraction:
cartextranss.duckdns.org:2404
Dropper Extraction:
http://thepunchlineexpose.com/wp-includes/certificates/AnyDesk.exe
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/f4177fb3986e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/f4177fb3986e1f8c74df732b13752ece8d3dbb2e2ea6969b0cf328fc71ebd400

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_ZLoader_xls_20210125
Create hunting rule
Author:abuse.ch
Description:Detects ZLoader XLS

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Excel file xls f4177fb3986e1f8c74df732b13752ece8d3dbb2e2ea6969b0cf328fc71ebd400

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/196261/

Comments