New Remcos Campaign Distributed Through Fake Shipping Document

MITRE Techniques

• [T1566] Phishing – Brief description: The campaign begins with a phishing email that lures recipients to open a malicious Word attachment. (‘The captured phishing email, disguised as a message from a shipping company in Vietnam, lures the recipient to open an attached Word file to view an updated shipping document.’)
• [T1203] Exploitation for Client Execution – Brief description: A crafted RTF triggers CVE-2017-11882 in the Microsoft Equation Editor to execute shellcode. (‘…triggers CVE-2017-11882, a known Remote Code Execution (RCE) vulnerability in the Microsoft Equation Editor (EQNEDT32.EXE).’)
• [T1059.001] Command and Scripting Interpreter: PowerShell – Brief description: PowerShell is used (Base64-encoded) to load a .NET module into memory and invoke its VAI() method. (‘powershell -NoProfile -WindowStyle Hidden -Command {Base64-decoded PowerShell code}’)
• [T1059.005] Command and Scripting Interpreter: Visual Basic / VBScript – Brief description: A VBScript downloader/launcher contains Base64-encoded PowerShell and is executed to spawn the PowerShell payload. (‘The VBScript file is lightly obfuscated and contains a Base64-encoded PowerShell code.’)
• [T1105] Ingress Tool Transfer – Brief description: Multiple files (RTF, VBScript, image with embedded .NET, Remcos payload) are downloaded from remote hosts during the chain. (‘The shellcode’s primary function is to download a VBScript file from a decrypted URL.’ / ‘The .NET module downloads the file and keeps it in memory… the file contains the Remcos agent payload.’)
• [T1055.012] Process Injection: Process Hollowing – Brief description: The Remcos payload is injected into a newly created colorcpl.exe process using process hollowing to run filelessly. (‘deploys the Remcos payload into a newly created colorcpl.exe process using process hollowing.’)
• [T1053.005] Scheduled Task/Job: Scheduled Task – Brief description: The .NET module creates a scheduled task named “5V3EBWmhxc” to achieve persistence and repeatedly execute the downloaded VBS. (‘the .NET module creates a scheduled task (named “5V3EBWmhxc”) in the Windows Task Scheduler to maintain persistence’)
• [T1620] Reflective Code Loading – Brief description: A .NET assembly is loaded directly into the PowerShell process via reflection ([Reflection.Assembly]::Load()) to execute in-memory. (‘After decoding, the code calls the [Reflection.Assembly]::Load() method to load the .NET module into the PowerShell’s process and invokes its VAI() method’)