Beware of Phishing Emails That Disguise Themselves as Project Material Purchase Requests
Phishing emails disguised as Korean project material purchase requests deliver XLS files exploiting CVE-2017-0199 to download and execute Remcos RAT via steganographic payload delivery. The campaign uses CVE-2017-0199 OLE2Link in malicious XLS attachments to download HTA files from C2. HTA executes obfuscated PowerShell via WMI, which retrieves a steganographic PNG containing a .NET loader. The loader downloads Remcos RAT, enabling keylogging, screen capture, and data exfiltration. C2 infrastructure spans a dedicated IP, a Cloudflare Workers domain, and a DuckDNS subdomain.
Detection / Hunteropenrouter
Immediate Actions
- Block IP 172.245.209.133 and domain blessedongrace.duckdns.org at firewall and proxy
- Block the three C2 URLs at web gateway and DNS resolver
- Quarantine any XLS attachments matching the listed MD5 hashes
- If EDR supports host isolation, isolate hosts communicating with C2 infrastructure
Key Takeaways
- CVE-2017-0199 OLE2Link exploit in XLS triggers automatic HTA download upon document open
- HTA uses WMI Win32_Process.Create() to execute obfuscated PowerShell in background
- Steganographic PNG hides Base64 .NET loader extracted using 'IN-' and '-inl' markers
- Remcos RAT C2 operates on blessedongrace.duckdns.org port 19700
- Three MD5 hashes provided for malicious files including XLS, HTA, and PNG
Attack Chain
- Initial Access: Phishing email delivers malicious XLS disguised as project material purchase request
- Execution: CVE-2017-0199 OLE2Link auto-downloads HTA file from C2 on document open
- Execution: HTA uses WMI Win32_Process.Create() to run obfuscated PowerShell
- Defense Evasion: PowerShell downloads steganographic PNG, extracts .NET loader via marker strings
- C2: Loader downloads Remcos RAT from C2 and executes in memory
- Collection: Remcos RAT performs keylogging, screen capture, and data exfiltration to C2
Affected Systems
- Microsoft Office Excel (unpatched for CVE-2017-0199)
- Windows endpoints with PowerShell and WMI
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2017-0199 | Microsoft Office (OLE2Link) | High | RCE flaw exploiting OLE2Link to auto-download and execute external HTA files on document open. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | WMI process creation and PowerShell execution visible but obfuscation and in-memory loading hinder analysis. |
| Network Visibility | Medium | HTTP/S connections to C2 IPs and domains visible; Cloudflare Workers traffic may blend with legitimate use. |
| Detection Difficulty | Moderate | Multi-stage chain with obfuscation and steganography, but known CVE and RAT produce detectable behaviors. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| WMI Win32_Process.Create spawning obfuscated PowerShell from mshta.exe parent process (T1047, T1059.001, T1218.005) | Process creation, WMI activity, PowerShell script blocks | Execution | Low — WMI spawning PowerShell from HTA is rare |
| Office applications initiating outbound HTTP/S connections to external IPs immediately after document open (T1203, T1105) | DNS queries, network connection logs, process network events | Initial Access | Medium — some Office features fetch external content |
| PNG files containing Base64-encoded .NET assemblies extracted via marker string patterns (T1027.009) | File write events, PowerShell script block logs | Defense Evasion | Low — steganographic extraction is unusual in enterprise |
Required Log Sources
- WMI activity logs
- PowerShell script block logs
- DNS query logs
- HTTP/S proxy logs
- Process creation events (Sysmon EID 1)
- Office macro exploitation logs
Key Behavioral Indicators
- Excel process spawning network connections to external IPs
- mshta.exe executing from Office document temp paths
- WMI Win32_Process.Create spawning powershell.exe from mshta.exe
- PowerShell downloading PNG files from Cloudflare Workers subdomains
- Remcos RAT beaconing to DuckDNS subdomain on non-standard port
- In-memory .NET assembly loading via reflective techniques
Control Gaps
- Legacy CVE-2017-0199 may remain unpatched on older Office installations
- Steganographic payload extraction bypasses file-based AV signatures
- Obfuscated PowerShell may evade script block logging on older Windows
- DuckDNS dynamic domain may not be blocked by domain filtering
False Positive Assessment
Low — C2 IP, DuckDNS domain, and Cloudflare Workers subdomain are specific to this campaign; behavioral indicators like WMI-spawned PowerShell from HTA are rare in normal operations.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Patch all Microsoft Office installations for CVE-2017-0199
- Disable OLE2Link automatic external content fetching via Group Policy
- Block .hta file execution via application control policies
- Restrict DuckDNS and Cloudflare Workers domains via DNS filtering where feasible
User Protection
- Enable Microsoft Office Protected View for files from email
- Deploy EDR rules for WMI spawning PowerShell from HTA processes
- Configure PowerShell script block logging and transcription on all endpoints
- Alert on Office applications making outbound HTTP/S connections
Security Awareness
- Train staff to verify sender domains on purchase request emails
- Instruct users to report unexpected XLS attachments from external senders
- Remind employees not to enable content or macros in unsolicited documents
MITRE ATT&CK Mapping
Initial Access
Execution
Stealth
Credential Access
Collection
Command and Control
Plain-Language Summary
Attackers are sending fake project material purchase request emails to Korean companies. The emails contain Excel files that exploit a 2017 Microsoft Office vulnerability to silently download malware. The malware hides its final payload inside an image file using steganography, then installs Remcos, a remote access tool that lets attackers record keystrokes, capture screens, and steal files. Organizations should block the listed malicious addresses, patch Microsoft Office, and train staff to verify unexpected purchase request emails before opening attachments.
Additional IOCs
- File Hashes:
5055c7b0ae1f6f77b16eb744a76cc453(MD5) - Malicious file hash associated with phishing campaign623bc9114d118592170599585e5cf60e(MD5) - Malicious file hash associated with phishing campaigndb9ff235eae552276b12622ae9105f1c(MD5) - Malicious file hash associated with phishing campaign
- Command Lines:
- Purpose: Execute obfuscated PowerShell script from HTA via WMI | Tools:
wmi,powershell,mshta| Stage: Execution |Win32_Process.Create() - Purpose: Download steganographic PNG and extract Base64 .NET loader using marker strings | Tools:
powershell| Stage: Defense Evasion
- Purpose: Execute obfuscated PowerShell script from HTA via WMI | Tools:
- cveCVE-2017-0199RCE flaw exploiting OLE2Link to auto-download and execute external HTA files on document open.
- domainblessedongrace[.]duckdns[.]orgRemcos RAT C2 domain on port 19700
- ip172[.]245[.]209[.]133C2 server hosting HTA and Remcos RAT PNG payloads
- md55055c7b0ae1f6f77b16eb744a76cc453Malicious file hash associated with phishing campaign
- md5623bc9114d118592170599585e5cf60eMalicious file hash associated with phishing campaign
- md5db9ff235eae552276b12622ae9105f1cMalicious file hash associated with phishing campaign
- urlhxxp://172[.]245[.]209[.]133/70/img_201031[.]pngRemcos RAT steganographic PNG download URL
- urlhxxp://172[.]245[.]209[.]133/70/weprovideforbesthingstocomebackgoodthings[.]htaHTA payload downloaded via CVE-2017-0199 OLE2Link
- urlhxxps://muddy-sound-e0cd[.]nodetectonn[.]workers[.]dev/HIsPqSteganographic PNG download URL on Cloudflare Workers
![hxxp://172[.]245[.]209[.]133/70/img_201031[.]png](/iocs/url/http%3A%2F%2F172.245.209.133%2F70%2Fimg_201031.png){kind=link}