Rewterz Threat Alert – Banks in West Africa Hit with Off-TheShelf Malware, Free Tools

SEVERITY: Medium

ANALYSIS SUMMARY

Attacks hitting financial organizations in West Africa since at least mid-2017 rely on off-the-shelf malware, free hacking tools, and utilities already available on the target systems to steal credentials, install backdoors, and run commands.
Actively four campaigns are observed which are used to lure victims into the trap.

• NanoCore trojan and PsExec
• Cobalt Strike, PowerShell scripts, and free tools
• Mimikatz and Custom RDP

NanoCore trojan and PsExec

In one of the attacks, the threat actor used NanoCore trojan along with PsExec, a legitimate network administration tool, and delivered the malware via phishing emails. To lure the victim into installing the malware, the attacker used documents referring to a West African bank. The targets were in Ivory Coast and Equatorial Guinea.

Cobalt Strike, PowerShell scripts, and free tools

It combined malicious PowerShell scripts with Mimikatz, a hacking tool designed to steal credentials, and UltraVNC opensource software for remote administration. The attackers also used a dynamic DNS service to hide their location by assigning a custom domain name to the IP address of the C2 server.

Mimikatz and custom RDP

Mimikatz can be used to harvest credentials and RDP allows for remote connections to computers, it’s likely the attackers wanted additional remote access capability and were interested in moving laterally across the victim’s network.

IMPACT

• Remote Access
• Code Execution
• System compromise

INDICATORS OF COMPROMISE

URLs

• nemesis225[.]ddns[.]net
• moneygram[.]servehttp[.]com
• noreply377[.]ddns[.]net

Malware Hash (MD5/SHA1/SH256)

• 24015acd155ec7305805dbdff1dd074d
• 4d49e578d359185324acda70a2880dd5
• 64b88486170e5cb890a7486965a90e84
• a8372b48280c6ee5b225f8ccd3cf4814
• 8dd3e20fe9770843bc2c9b2523a7cfb2
• 470cdc0ea9caed534b14bd5e195d19e8
• 605e99ea7dc4e73ae2af59cfb03360ec
• e8828b155567e587fbeca9069289e0d9
• 80a2576c3148ba5123aa016bf01e72bba53995b172dd263ab2071fad1c9d548d
• 21c87bcccf7e5c164da7c94772ef71a065a862f9ce32341a38eb39ffb7804305
• dab1953b9135a9bf0c5ffe86b87ab9a9c6fa34482004aa8bb2bf7ea8d72c8c62
• 53f8afe36e562c92140f4f8fa1f8ffce9e1f48b1eaff96bd6ab4b03646b97dc3
• 8fe18a768769342be49ac33d2ba0653ba7f105a503075231719c376b6ded8846
• 5f456a55f18bf183a7c988617787a041b90e8ecbeed8a01c583597b3fd19b42e
• ce58546eebd3c8e218b1db19c9c7b5ffe086ee814aab0e891061f8cba954b14d
• 3b7cc16fa5c5a78f0d1816d09a71b835f589de842b20e8c96c7084b9b0a89ff3
• 97034d8a97b967b2f18a867b411552f7
• 332a5371389a8953a96bf09b69edcb6e
• 8184f24a4f4ff4438dba050b2e3d1af7
• 6bfc1ec16f3bd497613f57a278188ff7529e94eb48dcabf81587f7c275b3e86d
• e46ba4bdd4168a399ee5bc2161a8c918095fa30eb20ac88cac6ab1d6dbea2b4a
• c1993735265f4274b81a6edf789e0245f2f7f5ee78f4172101728a324cdd3d2d
• 49ae7d13f43bb04ed31d593787d4e17e
• 75e5594c6882704ea2889e3fd758cbbf
• 06fe2b7ff6af10cd0ec8395490567f8a0f66d8e083a72f57f18e9ad74dfff727
• 6eb3281f5a80223a5b58af20d415453a9013a487c89d89cd7658bb7451902548

REMEDIATION

Consider blocking the IoCs at their respective controls.