Rewterz Threat Alert – Threat Actors Targeting Banks Using Tools to Bypass Cyber Security Controls

Severity

Medium

Analysis Summary

Advanced techniques, tools and procedures (TTPs) have been observed being used by a new threat actor in order to bypass cyber controls used by many corporations. This threat actor is targeting financial organizations like banks with more sophisticated tools, complex obfuscation and customization. The attack begins with a phishing email containing a malicious link that downloads a word document. Examples of URLs created by the threat actor include hxxps://socgen-cert[.]com/documents/REQ-193.doc and hxxps://ing[]cert[.]com/documents/PO-2815.doc. The documents were also seen on amf-fr[.]org, alerts-swift[.]com, and socgencompliance[.]com.

Initial Access: Spear Phishing Link

Execution: Scripting, PowerShell, User Execution, Regsvr32

Persistence: Registry Run Keys / Startup Folder (in older versions)

Defense Evasion: Masquerading, Regsvr32, Download New Code at Runtime

Command and Control: Remote Access Tools, Uncommonly Used Port

Impact

Security Bypass

Complex Cyber-attack

Indicators of Compromise

IP(s) / Hostname(s)

• 51.38.150[.]171
• 80.82.64[.]126
• 82.221.128[.]183
• 185.10.68[.]29
• 185.10.68[.]189
• 185.10.68[.]20
• 185.117.73[.]234
• 191.101.172[.]26
• 198.50.239[.]63

URLs

• nlscdn[.]com
• ing-cert[.]com
• riscomponents[.]pw
• socgen-cert[.]com
• amf-fr[.]org
• alerts-swift[.]com
• finanstilsy[.]net4

Malware Hash (MD5/SHA1/SH256)

• 9111e08fd904e25defd6ba0a98142410
• 39cbce484f3769eb23ea8dab0077d38c
• 1d9aa66eebb174742433d88347c88243
• e04c69af05c40d5e8a8ab4941d4aad24
• efbcffc10763a287bdedfb6e892ae20c
• 0d42a54f427c044c59b0777b9ddf3eb3
• 8ec83dba30c4f4d014899fbcc9a78171
• 487982bc6f4a82556f0ab3c219f55ae0
• a7e5ee61098748ffb9c42e65cdad6505
• f65811df2f65507099c7147da07c05d0
• 981f0fbaed1b125cc3fb9fa5a4418969
• db1b9ebe9d782874e6aa4bc7509626b4
• 073ede09792ec2995d403b8076516e06
• 2a7d037d059f348f5fd0545396cb728f
• 3d91a135ebb28a25dc525fd6a407693a
• 65efb4aabcb3ad60b44d50a54841ea4b
• 9a39f0099f884c96130f4f5a402a82af
• 6abb9951a1daa868116becc72812ea8b
• 87f36cfeb984559d10232d6160b9eb30
• 09e2a5b102f82c3cd0e1b7cc23152432
• 835e69a43117eab940f8d9505642bd7c
• cf3a6d21b2b8e728f63ec3f822575c28
• b43d81328845e8aeba2ca40eb6979ece
• 66c8986971d3e8662e2351fe937c2191
• 9e6810fcf7bba8f51ee7010b4d4751a3
• efbcffc10763a287bdedfb6e892ae20c
• 50dc84e07a7923f0e415d0cfe26bfaad
• a7e5ee61098748ffb9c42e65cdad6505
• 8cf07b203063067472743c1b8cca6631
• 413aa1e29e3f0564feb48ea482dc717adb75a40f2abbf2471566a05935f45b01
• bee422ce01607b48c6d2c322caadf9fe050b9a916d751fc9facd9fa3edf46d14
• d57f128afb4843b6f0072fadda8dd14046b31703098e365bc5a226e117090d44
• 2f5a668c0c8366dfbf337c8390b0cd2a976ecbe1b47bdfb221c22703432d45db
• a1093d68e9f9f511ecf1cc38c457dda00318bb97633b36b8383d45b66f41eeec
• 511db1ca13761147e26229795cab3ddd1f0a0c00a677da93628183ff5d2e2639
• 9a72b7af8c9a00542c83959cfee61e7be9a831717dc1ff27227bea63e36da004
• e2bec3d92896f0007a1811310c96eb7333a66142558057c482b5fb2196ff22e1
• 59a24d9ac0ed2f2bea3883d7b943ab1229acfe3f9f350f2dee6deb14c559920b
• 08a1a6ecdccc13695968545b2888a91eb0f05ef60e1bde9e86c4a9b386395af7
• 515449cdae6f9b997a3a73c1e0244808d4dc5aef77e74bfc3006f099a27cfe1d
• c32856605c7bc754b5649e90863f58e25f094dceeac5546bc27220e9313ae1c5
• 822f38009000278b26c916f52bfbeec93a894464cb8645353faf1f3aad2b5327
• eb4eea0dfb1a0b1bd7e2d3e6e932f2f86877d046b330bde6efc6169f5b3a0981
• a87d22f102a186710dce923c729f960e3f8b5147161965716ef95ce0d857bfc9
• 728bbbea8797c5e00a8737ebf6bebfffb3d84f9c86f144963a2940025329c28b
• f4d208c6df8571f7992a500d3787b4685907914e6445159e57921e77f8285208
• 471545026007c352f60c75355221cd13784ed3499dbd9eeb221fe7824ade0842
• 546aea2f9b7351c4efdec0dc197f057144af12f7e3617aa0d79353b1160508d1
• 87eac683f348971d3afc6daa13669d4830e7497d6a6edb61a34ab1b2b93ae0f7
• 25ae00c80a4ec85cb548c891598cf76d131b168a70116a84cb62b4defa3f698c
• 7065f6be16923215d3e7cbd5d769a7ca3721279c16085339a449959b6fb18ab3
• ad18110f61e18af03902b0b14a0dddcd312e627bcd278e12a245e2f4831db829
• df9447faeb4c1f8b463d81515448767848a1c1d05d32fd745b7b8cd2ce3766c8
• b9f987ef7a0c57a851c20832dbf58883e64ec6e513718b506e20ca2f71c241c8
• e2566eb542898662f5a8a5717d7990e988ebaedb2445fe4f3bf0dab166e13e5c
• db526cb59caa89c533032cee02b738be48699517a673e8870efa44ef2b8c1eb3
• b991288ecd158e84076f7cc38d4ecbcd18cccc580f1971b0dfdd7c88b78e0794

Remediation

• Block the threat indicators at their respective controls.
• Ensure strict measures against phishing emails.