Rewterz Threat Alert – TA2101 Plays Government Imposter to Distribute Ransomware

Severity

High

Analysis Summary

TA2101 is found targeting German companies and organizations to deliver and install backdoor malware. This actor is distributing Maze ransomware through Microsoft Word attachments, which when opened execute a Microsoft Office macro that, in turn, executes a PowerShell script, which downloads and installs the Maze ransomware payload onto the victim’s system.
The lure appears to be a notification of law enforcement activities (“aggiornamento: attivita di contrasto all’evasione”) and states that the recipient should open and read the enclosed document in order to avoid further tax assessment and penalties.

The emails, as part of a low-volume campaign across multiple verticals, were targeted primarily at manufacturing companies, businesses and IT service companies and used an infection chain of Microsoft Office macros into a PowerShell script, which ultimately downloads and installs Maze ransomware. Opening the Microsoft Word Document and enabling macros installs Maze ransomware on the user’s system, encrypting all of their files, and saves a ransom note resembling the following in TXT format in every directory.

Impact

• Financial loss
• Files Encryption

Indicators of Compromise

Domain Name

agenziaentrate[.]icu

From Email

• antowortensienicht@bzst-infomieren[.]icu
• info@agenziaentrate[.]icu
• antwortensienicht@bzstinform[.]icu

MD5

• 80043a5b285da88fb63d469243655751
• 53d5bdc6bd7904b44078cf80e239d42b
• ad30987a53b1b0264d806805ce1a2561
• 1ffecd461b3d4b65e44faff8537f68d6
• c09af442e8c808c953f4fa461956a30f
• ee26e33725b14850b1776a67bd8f2d0a
• 2fbd10975ee65845a18af6b7488a5236

SH256

• 44991186a56b0d86581f2b9cc915e3af426a322d5c4f43a984e6ea38b81b7bed
• cfd8e3a47036c4eeeb318117c0c23e126aea95d1774dae37d5b6c3de02bdfc2a
• 9f2139cc7c3fad7f133c26015ed3310981de26d7f1481355806f430f9c97e639
• 5f1e512d9ab9b915b1fc925f546ed559cbfa49df53229e2f954a1416cf6f5ee4
• 97043f23defd510607ff43201bb03b9916a23bd71b5bdf97db357e5026732506
• d617fd4b2d0824e1a7eb9693c6ec6e71447d501d24653a8e99face12136491a8
• 7e3ab96d2628e0a9970802b47d0356dc9b99994d7f98492d4e70a5384891695a

URL

• hxxp[:]//198.50.168.67/wordpack[.]tmp
• hxxp[:]//conbase.top/sys[.]bat
• hxxp[:]//104.168.198[.]208/wordupd.tmp
• hxxp[:]//104.168.215[.]54/wordupd.tmp
• hxxp[:]//104.168.174[.]32/wordupd_3.0.1.tmp
• hxxp[:]//192.119.68[.]225/wordupd1.tmp
• hxxp[:]//108.174.199[.]10/wordupd3.tmp
• hxxp[:]//54.39.233[.]175/wupd19823.tmp
• hxxp[:]//54.39.233[.]131/word1.tmp
• hxxp[:]//104.168.198[.]230/wordupd.tmp

Remediation

• Block the threat indicators at their respective controls.
• Do not download files attached in untrusted emails.
• Do not enable macros for untrusted files.