Rewterz Threat Alert – GrandCrab and Ursnif Campaign Observed in the Wild

SEVERITY: Medium

CATEGORY: Phishing

ANALYSIS SUMMARY 

A campaign distributing both Ursnif malware and GrandCrab ransomware via malicious Word documents attached to phishing emails. The Word documents contained a VBS macro that executes a base64 encoded PowerShell script. The PowerShell script is used to retrieve the files associated with the GrandCrab and Ursnif infections. The first payload that is downloaded and executed is a PowerShell command used to download an additional PowerShell script. This additional PowerShell script contains a base64 encoded PE file which it injects into memory for execution. This PE file was identified to be a variant of the GrandCrab ransomware. The second payload that is download and executed via the VBS macro is the Ursnif executable, which is used for malicious activities such as gathering system information and harvesting credentials.

Impact

Leakage of system information
Loss of credentials

INDICATORS OF COMPROMISE

URLs

bevendbrec[.]com
iscondisth[.]com

Malware Hash (MD5/SHA1/SH256)

c064f6f047a4e39014a29c8c95526c3fe90d7bcea5ef0b8f21ea306c27713d1f
d6c53d9341dda1252ada3861898840be4d669abae2b983ab9bf5259b84de7525
0a3f915dd071e862046949885043b3ba61100b946cbc0d84ef7c44d77a50f080

Remediation

Block all URL’s and IoC’s at your respective controls.
Ensure anti virus software and associated files are up to date.
Always be suspicious about emails sent to users from unknown senders.