5 minhigh
Beware of phishing emails disguised as quote requests
Phishing emails disguised as project quote requests deliver Remcos RAT via VBScript with token obfuscation, UAC bypass, and process injection into MicrosoftEdgeUpdate.exe. Attackers deliver RAR attachments containing obfuscated VBScript that constructs PowerShell commands through token substitution. The script downloads a multi-stage payload from Google Drive, bypasses UAC via ShellWindows COM object, and injects Remcos RAT into MicrosoftEdgeUpdate.exe for remote access and data theft.
Sens:■ ImmediateConf:high
IOCs5
2url1file path1ip1md5
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block network connections to 102.220.160.104 on port 2404
- Block Google Drive download URLs with specified file IDs at proxy
- Hunt for %APPDATA%\Maleic.For across endpoints
- Quarantine systems beaconing to Remcos RAT C2
Key Takeaways
- VBScript extracts characters 's' and 'l' from notepad.exe hex data to construct powershell string
- Token substitution replaces Axis with S, Longar with O, Hoimulz with $, Humoled with C
- Payload stored in %APPDATA%\Maleic.For with three sections: loader, payload, secondary PowerShell
- UAC bypass via ShellWindows COM object with CLSID {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
- Remcos RAT C2 server at 102.220.160.104 communicating on port 2404
Attack Chain
- Initial Access: Phishing email delivers RAR attachment containing hidden VBScript
- Execution: VBScript constructs PowerShell command from notepad.exe hex data with token substitution
- Ingress Tool Transfer: PowerShell downloads multi-section payload from Google Drive to %APPDATA%\Maleic.For
- Privilege Escalation: ShellWindow COM object bypasses UAC via explorer.exe ShellExecute
- Process Injection: Loader XOR-decrypts payload and injects Remcos RAT into MicrosoftEdgeUpdate.exe
- Command and Control: Remcos RAT communicates with 102.220.160.104:2404 for remote commands and data exfiltration
Affected Systems
- Windows systems with PowerShell enabled
- Systems with Microsoft Edge installed
- Email clients receiving external messages
- Corporate networks with outbound internet access
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | High | PowerShell execution, COM object creation, process injection visible to EDR |
| Network Visibility | Medium | C2 IP visible but Google Drive is legitimate infrastructure |
| Detection Difficulty | Moderate | Obfuscated scripts but behavioral indicators are detectable |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| VBScript files reading notepad.exe hex data to construct PowerShell command strings (T1059.005, T1027) | VBScript process reading notepad.exe | Execution | Low — notepad.exe hex reading is abnormal |
| MicrosoftEdgeUpdate.exe spawning from unexpected parent processes or with PowerShell ancestry (T1055) | Process creation logs for MicrosoftEdgeUpdate.exe | Process Injection | Low — Edge update has known parent processes |
| PowerShell creating ShellWindow COM objects for UAC bypass followed by elevated execution (T1548.002) | COM object creation and PowerShell process events | Privilege Escalation | Medium — COM object creation is common |
| Processes downloading files from Google Drive export=download URLs followed by in-memory execution (T1105) | Network proxy logs and process execution events | Ingress Tool Transfer | Medium — Google Drive downloads are common |
Required Log Sources
- PowerShell Script Block logs (4104)
- Process creation logs (4688/1)
- COM object instantiation logs
- Network proxy or firewall logs
- File system audit logs
Key Behavioral Indicators
- VBScript reading notepad.exe to construct PowerShell command strings
- PowerShell token substitution using Axis, Longar, Hoimulz, Humoled
- ShellWindow COM object creation followed by elevated PowerShell
- MicrosoftEdgeUpdate.exe with unexpected parent process
- File written to %APPDATA%\Maleic.For
- Network connections to Google Drive with export=download parameter
Control Gaps
- Email gateways may not scan RAR attachments for VBScript
- URL filtering may not block Google Drive download links
- Application whitelisting may not cover MicrosoftEdgeUpdate.exe
- UAC bypass detection requires COM object monitoring
False Positive Assessment
Low — token substitution tokens and %APPDATA%\Maleic.For path are specific to this campaign
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Block outbound connections to 102.220.160.104:2404 at perimeter firewall
- Filter Google Drive download URLs with export=download and long file ID parameters
- Enable PowerShell Script Block logging and Module logging via GPO
- Restrict VBScript execution via Windows Script Host for non-admin users
User Protection
- Enable email attachment scanning for RAR files containing VBScript
- Configure EDR to alert on MicrosoftEdgeUpdate.exe with unexpected parent processes
- Enable Windows Defender Attack Surface Reduction rules for script-based execution
- Block VBScript execution from email-derived attachments
Security Awareness
- Train users to verify sender email domains before opening attachments
- Warn staff about phishing emails disguised as project quote requests
- Instruct users to report emails with RAR attachments containing script files
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping12 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Privilege Escalation
Tactic
Credential Access
Tactic
Collection
Tactic
Command and Control
Plain-Language Summary
Attackers send fake business emails pretending to request project quotes, tricking recipients into opening an attached file. The attachment runs hidden code that downloads remote control software (Remcos RAT) from a file-sharing service, giving attackers full access to the victim's computer, including keystroke logging and screen capture. Organizations should verify sender addresses and block suspicious file attachments to prevent this attack.
Additional IOCs
- File Paths:
%APPDATA%\Maleic.For- Attacker-dropped payload file with three sections
- Command Lines:
- Purpose: VBScript extracts chars from notepad.exe hex to construct powershell command | Tools:
wscript.exe,cscript.exe,notepad.exe| Stage: Execution - Purpose: ShellWindow COM object bypasses UAC via explorer.exe ShellExecute | Tools:
explorer.exe,powershell.exe| Stage: Privilege Escalation |explorer.exe - Purpose: PowerShell decodes token-substituted obfuscated strings and downloads payload | Tools:
powershell.exe| Stage: Execution
- Purpose: VBScript extracts chars from notepad.exe hex to construct powershell command | Tools:
Showing defanged values
- file_path%APPDATA%\Maleic.ForAttacker-dropped payload file with three sections
- ip102[.]220[.]160[.]104Remcos RAT C2 server communicating on port 2404
- md5af87821d3cb4f1d72bfb8002437593ecMalicious file hash for initial dropper
- urlhxxps://drive[.]google[.]com/uc?export=download&id=1ge2-tdX0-_A6ZU6FDMEFynhz1m0L5lHmStage 2 payload download from Google Drive
- urlhxxps://drive[.]google[.]com/uc?export=download&id=1yJZysgMU6LZmCZtpko0y1uO1jsbYDIRORemcos RAT download from Google Drive