9 minhigh
Beware of Phishing Emails Disguised as Money Transfer Confirmations
A phishing campaign targeting Korean organizations delivers malicious XLS files disguised as payment confirmation notices. The XLS files exploit CVE-2017-0199 to download and execute an HTA file, which in turn launches an obfuscated PowerShell script via WMI. The PowerShell script retrieves a steganographically embedded PNG containing a .NET loader, which ultimately downloads and executes Remcos RAT for persistent remote access and data exfiltration.
Sens:▲ 24hConf:high
Showing defanged values
- domainblue-paper-f69f[.]acrypters[.]workers[.]devCloudflare Workers domain hosting the steganographic PNG file used to deliver the .NET loader
- domainguhudeolokghguhumandeylikebroemdfhhfhsjj[.]duckdns[.]orgRemcos RAT C2 server for command and control communication on port 4087
- ip144[.]172[.]104[.]196C2 server used for downloading the malicious HTA file (CVE-2017-0199 stage) and the Remcos RAT payload
- md51ae66686d91145b0707c32ff43664f70MD5 hash of a malicious file associated with this campaign
- md52a0f1960fb6338537c3a366daaa28abbMD5 hash of a malicious file associated with this campaign
- md566de4988c67e911479a20a3cd3e4990dMD5 hash of a malicious file associated with this campaign
- md5c184f43536a78459acef0082d1a25976MD5 hash of a malicious file associated with this campaign
- urlhxxp://144[.]172[.]104[.]196/35/smallbackpackcomingfromthebestplaces[.]htaHTA file downloaded via CVE-2017-0199 exploitation from the malicious XLS document
- urlhxxp://144[.]172[.]104[.]196/Vzt/vzt_175159[.]catRemcos RAT payload downloaded by the .NET loader stage
- urlhxxps://blue-paper-f69f[.]acrypters[.]workers[.]dev/FTM0-40PO-AO28-G98E/img_qiql6d[.]pngSteganographic PNG file containing a Base64-encoded .NET loader, hosted on a Cloudflare Workers domain
![hxxps://blue-paper-f69f[.]acrypters[.]workers[.]dev/FTM0-40PO-AO28-G98E/img_qiql6d[.]png](/iocs/url/https%3A%2F%2Fblue-paper-f69f.acrypters.workers.dev%2Fftm0-40po-ao28-g98e%2Fimg_qiql6d.png){kind=link}
Detection / Hunteropenrouter
What Happened
Attackers are sending fake emails that look like payment confirmation notices from a Korean company. The emails contain a malicious spreadsheet file that, when opened, secretly downloads and runs malware by exploiting an old but dangerous vulnerability in Microsoft Office (CVE-2017-0199). The malware uses several layers of disguise, including hiding code inside an image file using a technique called steganography, before installing a remote access tool called Remcos RAT. This tool lets the attackers record keystrokes, capture screenshots, and manipulate files on the victim's computer. Organizations should ensure Microsoft Office is fully patched, train employees to verify email senders, and block the known malicious network addresses listed in the report.
Key Takeaways
- Phishing emails impersonate Korean company employees and deliver malicious XLS files disguised as payment confirmations
- The XLS file exploits CVE-2017-0199 (OLE2Link RCE) to automatically download and execute a malicious HTA file from a C2 server
- The HTA file uses WMI to launch an obfuscated PowerShell script that downloads a steganographically embedded PNG containing a .NET loader
- The .NET loader downloads and executes Remcos RAT, which provides keylogging, screen capture, and file manipulation capabilities
- Multiple C2 servers are used across the attack chain, including a Cloudflare Workers domain for steganographic PNG hosting
Affected Systems
- Microsoft Office (vulnerable to CVE-2017-0199)
- Windows endpoints targeted by Remcos RAT
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2017-0199 | Microsoft Office (OLE2Link) | High | Remote code execution flaw that exploits the OLE2Link feature in Microsoft Office to automatically download and execute additional malicious files when a user opens a crafted document. |
Attack Chain
- Initial Access: Phishing email disguised as payment confirmation delivers malicious XLS attachment to the victim
- Exploitation: XLS file exploits CVE-2017-0199 (OLE2Link) to automatically download and execute an HTA file from the C2 server
- Execution: HTA file uses WMI Win32_Process.Create() to execute an obfuscated PowerShell script in the background
- Defense Evasion/Execution: PowerShell script downloads a steganographically embedded PNG from a second C2 and extracts a Base64-encoded .NET loader using string markers
- Execution: .NET loader decrypts and loads the payload into memory, then downloads Remcos RAT from the C2 server
- C2/Exfiltration: Remcos RAT communicates with its C2 server to receive commands and exfiltrate data via keylogging, screen capture, and file manipulation
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide any detection rules or queries. It provides IOCs (MD5 hashes, URLs, IPs, and domains) and a response guide with general phishing awareness recommendations.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR should detect mshta.exe spawning PowerShell, WMI process creation, and Remcos RAT behavior. However, the steganographic extraction and in-memory .NET loading may be harder to detect without memory scanning capabilities. |
| Network Visibility | High | The attack chain involves multiple HTTP/HTTPS downloads from distinct C2 servers including a Cloudflare Workers domain and a DuckDNS domain, which should be visible in proxy and network logs. |
| Detection Difficulty | Moderate | The use of CVE-2017-0199 and mshta.exe spawning PowerShell is well-documented and detectable. However, the steganographic PNG extraction and in-memory .NET loading add complexity that may require additional memory analysis or behavioral detection. |
Required Log Sources
- Network proxy logs (HTTP/HTTPS traffic)
- DNS resolution logs
- Microsoft Office macro/OLE object execution logs
- Process creation events (Event ID 4688 / Sysmon Event ID 1)
- WMI activity logs (Sysmon Event ID 19, 20, 21)
- PowerShell script block logging (Event ID 4104)
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Look for mshta.exe processes spawning from Microsoft Office applications (Excel, Word), which would indicate exploitation of CVE-2017-0199 or similar OLE object vulnerabilities. | Process creation events showing parent-child relationship between Office applications and mshta.exe | Execution | Low - legitimate Office-to-mshta execution is extremely rare in enterprise environments |
| Hunt for WMI Win32_Process.Create() method invocations that spawn PowerShell processes, as this is used to execute the obfuscated PowerShell loader. | Sysmon Event IDs 19/20/21 for WMI activity and Event ID 1 for process creation with WMI as parent | Execution | Medium - some legitimate administrative tools use WMI for process creation |
| Search for network connections to DuckDNS subdomains with unusual port numbers, as Remcos RAT uses a DuckDNS domain on port 4087 for C2 communication. | DNS resolution logs and network firewall/proxy logs for *.duckdns.org domains | Command and Control | Low to Medium - DuckDNS is a legitimate dynamic DNS service but enterprise use is uncommon |
| Look for PowerShell processes downloading PNG files from Cloudflare Workers domains, which may indicate steganographic payload retrieval. | Network proxy logs showing PowerShell user-agent downloading image files from *.workers.dev domains | Defense Evasion | Low - PowerShell downloading PNG files from Workers domains is highly suspicious |
| Hunt for .NET assemblies loaded into memory from unusual parent processes, as the steganographic loader injects a .NET payload directly into memory. | ETW .NET assembly load events or EDR memory scanning capabilities | Execution | Medium - in-memory .NET loading is used by some legitimate applications |
Control Gaps
- Network-based detection may miss the steganographic payload extraction if the PNG download appears as legitimate image traffic
- Traditional antivirus may not detect the in-memory .NET loader since it is not written to disk
- Email gateway filtering may not flag XLS files as malicious if they contain no macros but instead use OLE2Link objects
- CVE-2017-0199 exploitation may bypass application whitelisting if mshta.exe is an allowed binary
Key Behavioral Indicators
- mshta.exe spawned by Microsoft Office applications (Excel.exe, Winword.exe)
- WMI Win32_Process.Create() method used to launch PowerShell from an HTA context
- PowerShell downloading PNG files from Cloudflare Workers (*.workers.dev) domains
- Network connections to DuckDNS subdomains on non-standard ports
- Remcos RAT behavioral patterns: keylogging, screen capture, and file manipulation activity
False Positive Assessment
Low - The IOCs are specific to this campaign (particular C2 IPs, DuckDNS domain, Cloudflare Workers URL) and the behavioral indicators (Office spawning mshta, WMI launching PowerShell) have low legitimate occurrence rates in enterprise environments.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking the identified C2 IP 144.172.104.196 and the DuckDNS domain on network firewalls and proxy servers.
- Consider adding the four MD5 hashes to your endpoint detection and response block lists if supported by your tooling.
- Evaluate whether your email gateway can be configured to quarantine XLS files containing OLE2Link objects, not just those with macros.
- If applicable, consider searching your environment for any existing connections to the Remcos RAT C2 domain on port 4087.
Infrastructure Hardening
- Consider ensuring all Microsoft Office installations are fully patched, particularly for CVE-2017-0199, which remains unpatched in many environments despite being disclosed in 2017.
- Evaluate whether blocking mshta.exe execution via application control or AppLocker would be feasible in your environment.
- Consider restricting outbound connections to dynamic DNS services such as DuckDNS if they are not used for legitimate business purposes.
- If your network architecture supports it, consider implementing egress filtering to block direct connections to known malicious IP ranges.
User Protection
- Consider deploying enhanced email filtering rules that flag payment-related emails with attachments from external or spoofed senders.
- Evaluate whether your endpoint protection can detect and block Remcos RAT behavior, including keylogging and screen capture activity.
- If supported by your EDR, consider enabling behavioral detection for PowerShell scripts that download image files from external sources.
Security Awareness
- Consider incorporating this phishing scenario into existing security awareness training, emphasizing verification of sender email addresses against official company domains.
- Remind users to be cautious with payment confirmation emails and to verify unexpected financial documents through out-of-band channels.
- Consider advising users to report any XLS files that display content but trigger external network connections or security warnings.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping9 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Command and Control
Additional IOCs
- File Hashes:
1ae66686d91145b0707c32ff43664f70(MD5) - MD5 hash of a malicious file associated with this campaign2a0f1960fb6338537c3a366daaa28abb(MD5) - MD5 hash of a malicious file associated with this campaign66de4988c67e911479a20a3cd3e4990d(MD5) - MD5 hash of a malicious file associated with this campaignc184f43536a78459acef0082d1a25976(MD5) - MD5 hash of a malicious file associated with this campaign
- Command Lines:
- Purpose: Execute obfuscated PowerShell script in the background via WMI | Tools:
WMI,PowerShell,mshta.exe| Stage: Execution |Win32_Process.Create(
- Purpose: Execute obfuscated PowerShell script in the background via WMI | Tools: