Detecting Malware Script Loaders using Remcos: Threat Research Release December 2021
Tags
cmtmf-attack-pattern: Process Injection
country: Argentina
maec-delivery-vectors: Watering Hole
attack-pattern: Data Credentials - T1589.001 Dns - T1071.004 Dns - T1590.002 Domains - T1583.001 Domains - T1584.001 Installutil - T1218.004 Ip Addresses - T1590.005 Malicious File - T1204.002 Malware - T1587.001 Malware - T1588.001 Phishing - T1660 Phishing - T1566 Powershell - T1059.001 Process Injection - T1631 Pubprn - T1216.001 Regsvr32 - T1218.010 Server - T1583.004 Server - T1584.004 Software - T1592.002 Web Service - T1481 Web Services - T1583.006 Web Services - T1584.006 Installutil - T1118 Powershell - T1086 Process Injection - T1055 Regsvr32 - T1117 Scripting - T1064 Windows Management Instrumentation - T1047 Web Service - T1102 Scripting
Show in Graph
Common Information
Type Value
UUID a8ede123-1d9d-4c89-83d2-2d70f08195c6
Fingerprint 8c4d0f340ced0641
Analysis status DONE
Considered CTI value 2
Text language
Published Jan. 10, 2022, 10:58 a.m.
Added to db Sept. 26, 2022, 9:34 a.m.
Last updated Nov. 18, 2024, 1:38 a.m.
Headline Detecting Malware Script Loaders using Remcos: Threat Research Release December 2021
Title Detecting Malware Script Loaders using Remcos: Threat Research Release December 2021
Detected Hints/Tags/Attributes 73/4/27
Source URLs
Redirection Url
Details Source https://www.splunk.com/en_us/blog/security/detecting-malware-script-loaders-using-remcos-threat-research-release-december-2021.html
URL Provider
Details Provider Source level domain
Details splunk.com www.splunk.com
Attributes
Details Type #Events CTI Value
Details Domain 45 
paste.ee
Details Domain 22 
research.splunk.com
Details File 6 
dynwrapx.dll
Details File 4 
pubprn.vbs
Details File 1 
c:\windows\winhlp32.exe
Details File 1 
sysmon.log
Details File 291 
user32.dll
Details File 748 
kernel32.dll
Details File 4 
winhlp32.exe
Details File 459 
regsvr32.exe
Details File 1 
%windir%\\system32\\regsvr32.exe
Details File 83 
installutil.exe
Details File 1 
%windir%\\syswow64\\wscript.exe
Details File 2127 
cmd.exe
Details File 35 
pwsh.exe
Details File 376 
wscript.exe
Details File 155 
cscript.exe
Details File 6 
dxdiag.exe
Details File 10 
webbrowserpassview.exe
Details File 3 
invoice.vbs
Details File 5 
remcos.dll
Details File 1 
stage1.vbs
Details sha256 1 
cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
Details sha256 1 
ff169ae934b92a2dfe78f4793c60256d4f36992a0e1218ed6b6d59b3809ed210
Details sha256 2 
4ef3a6703abc6b2b8e2cac3031c1e5b86fe8b377fde92737349ee52bd2604379
Details sha256 1 
c344723295279aaaf2a4220a77d74db903985264cf3adfba5015f9f31f0dddec
Details MITRE ATT&CK Techniques 310 
T1047