2021-08-19 Remcos RAT IOCs 2

THREAT IDENTIFICATION:  REMCOS RAT

SUBJECTS OBSERVED
Seperate Remittance Advice for <COMPANY NAME>

SENDERS OBSERVED
noreplyeft@wellsfargo.com
(Spoofed)

MALDOC FILE HASHES
Payment Advice 8.18.21.xls
699328d0323db4c8c28fe5408deca0a3

REMCOS PAYLOAD DOWNLOAD URLS
http://198.23.251.110/cop.exe

REMCOS PAYLOAD FILE HASHES
cop.exe
977a62444517295a0cfeb9e6e6f8e27a

Renamed and copied:
Gehnhmu.exe
977a62444517295a0cfeb9e6e6f8e27a

REMCOS C2
twistednerd.dvrlists.com:8618

ADDITIONAL TRAFFIC OBSERVED (may or may not be malicious)
a2q8ua.sn.files.1drv.com
62.102.148.152

onedrive.live.com
https://13.107.42.13

ADDITIONAL STRINGS FROM MEMORY
ETag: D6676A9A61E841F3!124.2

SUPPORTING EVIDENCE
https://urlhaus.abuse.ch/url/1544807/
https://app.any.run/tasks/d4a9cdfa-6961-4622-aaa9-418c9d4c2c10/
https://www.virustotal.com/gui/file/4b6fdf9cbea14e56b10f5e4d5c4c8fbe34de5454ec1b246814a9464e8c81e314/detection