Phishing XLS Exploits CVE-2017-0199 to Install Remcos RAT
Summary
AhnLab ASEC describes payment-themed phishing emails that deliver an XLS exploiting CVE-2017-0199. A WMI-launched PowerShell chain extracts a loader from a steganographic PNG and installs Remcos RAT.
Key points
- The emails impersonated employees of a Korean company and used payment-confirmation notices to lure recipients into opening a malicious XLS attachment.
- The XLS displayed a payment slip as a decoy and exploited CVE-2017-0199 to download and run an HTA file.
- The HTA used WMI Win32_Process.Create() to launch an obfuscated PowerShell script in the background.
- PowerShell extracted a Base64-encoded .NET loader from a steganographic PNG, decrypted it, and loaded it into memory.
- The loader downloaded Remcos RAT, which can execute remote commands and collect information through keylogging, screen capture, and file manipulation.
- The article advises verifying senders and URLs and examining suspicious attachments before opening them.
Article Details
- Attack Vectors
- Phishing emails impersonated employees of a company in Korea and presented a malicious XLS attachment as a payment confirmation.
- The XLS document exploited CVE-2017-0199 to retrieve and execute an HTA file.
- The HTA used WMI Win32_Process.Create() to launch an obfuscated PowerShell script, which downloaded a PNG containing steganographically embedded data.
- The extracted loader downloaded and executed Remcos RAT, which could receive remote commands and collect information through keylogging, screen capture, and file manipulation.
- Defensive Notes
- Verify that email senders use an official domain.
- Check links and attachments before opening them, including suspicious file extensions and URLs.
- Before entering sensitive information, verify that the URL is the official site and check its HTTPS certificate; do not proceed if in doubt.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | guhudeolokghguhumandeylikebroemdfhhfhsjj[.]duckdns[.]org | Remcos RAT C2 domain; the article gives port 4087. |
| IPV4 | 144[.]172[.]104[.]196 | C2 infrastructure identified as hosting the HTA and Remcos RAT-related downloads. |
| MD5 | 1ae66686d91145b0707c32ff43664f70 | MD5 hash listed by the article among samples associated with the malicious documents, scripts, or payloads. |
| MD5 | 2a0f1960fb6338537c3a366daaa28abb | MD5 hash listed by the article among samples associated with the malicious documents, scripts, or payloads. |
| MD5 | 66de4988c67e911479a20a3cd3e4990d | MD5 hash listed by the article among samples associated with the malicious documents, scripts, or payloads. |
| MD5 | c184f43536a78459acef0082d1a25976 | MD5 hash listed by the article among samples associated with the malicious documents, scripts, or payloads. |
| URL | hxxp[:]//144[.]172[.]104[.]196/35/smallbackpackcomingfromthebestplaces[.]hta | HTA download URL identified as part of the malicious infection chain. |
| URL | hxxp[:]//144[.]172[.]104[.]196/Vzt/vzt_175159.Cat | Remcos RAT download URL identified in the infection chain. |
| URL | hxxps[:]//blue-paper-f69f[.]acrypters[.]workers[.]dev/FTM0-40PO-AO28-G98E/img_qiql6d[.]png | Specific URL identified as delivering the PNG containing steganographically embedded payload data. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe HTA and PowerShell content were obfuscated, and the loader was Base64-encoded.T1027.003 · SteganographyThe PowerShell script retrieved a PNG containing steganographically embedded data, which it extracted.T1047 · Windows Management InstrumentationThe HTA used WMI Win32_Process.Create() to start PowerShell.T1056.001 · KeyloggingRemcos RAT was described as collecting information through keylogging.T1059.001 · PowerShellThe HTA launched an obfuscated PowerShell script in the background.T1071.001 · Web ProtocolsThe malware communicated with C2 infrastructure and retrieved payloads using HTTP/HTTPS URLs.T1105 · Ingress Tool TransferThe chain downloaded an HTA, a PNG payload, and Remcos RAT from remote infrastructure.T1113 · Screen CaptureRemcos RAT was described as collecting information through screen capture.T1140 · Deobfuscate/Decode Files or InformationThe loader extracted Base64-encoded data from the PNG and decrypted the resulting content.T1203 · Exploitation for Client ExecutionOpening the XLS document triggered exploitation of CVE-2017-0199 and execution of a downloaded HTA file.T1566.001 · Spearphishing AttachmentPhishing emails used a malicious XLS attachment disguised as a payment confirmation.