Rewterz Threat Alert – Threat Actors Targeting Banks Using Tools to Bypass Cyber Security Controls

Rewterz Threat Alert “Beyond The Grave” Virus – Threat Indicators

March 5, 2019

Rewterz Threat Alert – Threat Actors Targeting Banks Using Tools to Bypass Cyber Security Controls

March 6, 2019

Rewterz Threat Alert – Threat Actors Targeting Banks Using Tools to Bypass Cyber Security Controls

Severity

Medium

Analysis Summary

Advanced techniques, tools and procedures (TTPs) have been observed being used by a new threat actor in order to bypass cyber controls used by many corporations. This threat actor is targeting ﬁnancial organizations like banks with more sophisticated tools, complex obfuscation and customization. The attack begins with a phishing email containing a malicious link that downloads a word document. Examples of URLs created by the threat actor include hxxps://socgen-cert[.]com/documents/REQ-193.doc and hxxps://ing[]cert[.]com/documents/PO-2815.doc. The documents were also seen on amf-fr[.]org, alerts-swift[.]com, and socgencompliance[.]com.

Initial Access: Spear Phishing Link

Execution: Scripting, PowerShell, User Execution, Regsvr32

Persistence: Registry Run Keys / Startup Folder (in older versions)

Defense Evasion: Masquerading, Regsvr32, Download New Code at Runtime

Command and Control: Remote Access Tools, Uncommonly Used Port

Impact

Security Bypass

Complex Cyber-attack

Indicators of Compromise

IP(s) / Hostname(s)

51.38.150[.]171
80.82.64[.]126
82.221.128[.]183
185.10.68[.]29
185.10.68[.]189
185.10.68[.]20
185.117.73[.]234
191.101.172[.]26
198.50.239[.]63

URLs

nlscdn[.]com
ing-cert[.]com
riscomponents[.]pw
socgen-cert[.]com
amf-fr[.]org
alerts-swift[.]com
ﬁnanstilsy[.]net4

Malware Hash (MD5/SHA1/SH256)

9111e08fd904e25defd6ba0a98142410
39cbce484f3769eb23ea8dab0077d38c
1d9aa66eebb174742433d88347c88243
e04c69af05c40d5e8a8ab4941d4aad24
efbcﬀc10763a287bdedfb6e892ae20c
0d42a54f427c044c59b0777b9ddf3eb3
8ec83dba30c4f4d014899fbcc9a78171
487982bc6f4a82556f0ab3c219f55ae0
a7e5ee61098748ﬀb9c42e65cdad6505
f65811df2f65507099c7147da07c05d0
981f0fbaed1b125cc3fb9fa5a4418969
db1b9ebe9d782874e6aa4bc7509626b4
073ede09792ec2995d403b8076516e06
2a7d037d059f348f5fd0545396cb728f
3d91a135ebb28a25dc525fd6a407693a
65efb4aabcb3ad60b44d50a54841ea4b
9a39f0099f884c96130f4f5a402a82af
6abb9951a1daa868116becc72812ea8b
87f36cfeb984559d10232d6160b9eb30
09e2a5b102f82c3cd0e1b7cc23152432
835e69a43117eab940f8d9505642bd7c
cf3a6d21b2b8e728f63ec3f822575c28
b43d81328845e8aeba2ca40eb6979ece
66c8986971d3e8662e2351fe937c2191
9e6810fcf7bba8f51ee7010b4d4751a3
efbcﬀc10763a287bdedfb6e892ae20c
50dc84e07a7923f0e415d0cfe26bfaad
a7e5ee61098748ﬀb9c42e65cdad6505
8cf07b203063067472743c1b8cca6631
413aa1e29e3f0564feb48ea482dc717adb75a40f2abbf2471566a05935f45b01
bee422ce01607b48c6d2c322caadf9fe050b9a916d751fc9facd9fa3edf46d14
d57f128afb4843b6f0072fadda8dd14046b31703098e365bc5a226e117090d44
2f5a668c0c8366dfbf337c8390b0cd2a976ecbe1b47bdfb221c22703432d45db
a1093d68e9f9f511ecf1cc38c457dda00318bb97633b36b8383d45b66f41eeec
511db1ca13761147e26229795cab3ddd1f0a0c00a677da93628183ﬀ5d2e2639
9a72b7af8c9a00542c83959cfee61e7be9a831717dc1ﬀ27227bea63e36da004
e2bec3d92896f0007a1811310c96eb7333a66142558057c482b5fb2196ﬀ22e1
59a24d9ac0ed2f2bea3883d7b943ab1229acfe3f9f350f2dee6deb14c559920b
08a1a6ecdccc13695968545b2888a91eb0f05ef60e1bde9e86c4a9b386395af7
515449cdae6f9b997a3a73c1e0244808d4dc5aef77e74bfc3006f099a27cfe1d
c32856605c7bc754b5649e90863f58e25f094dceeac5546bc27220e9313ae1c5
822f38009000278b26c916f52bfbeec93a894464cb8645353faf1f3aad2b5327
eb4eea0dfb1a0b1bd7e2d3e6e932f2f86877d046b330bde6efc6169f5b3a0981
a87d22f102a186710dce923c729f960e3f8b5147161965716ef95ce0d857bfc9
728bbbea8797c5e00a8737ebf6bebﬀfb3d84f9c86f144963a2940025329c28b
f4d208c6df8571f7992a500d3787b4685907914e6445159e57921e77f8285208
471545026007c352f60c75355221cd13784ed3499dbd9eeb221fe7824ade0842
546aea2f9b7351c4efdec0dc197f057144af12f7e3617aa0d79353b1160508d1
87eac683f348971d3afc6daa13669d4830e7497d6a6edb61a34ab1b2b93ae0f7
25ae00c80a4ec85cb548c891598cf76d131b168a70116a84cb62b4defa3f698c
7065f6be16923215d3e7cbd5d769a7ca3721279c16085339a449959b6fb18ab3
ad18110f61e18af03902b0b14a0dddcd312e627bcd278e12a245e2f4831db829
df9447faeb4c1f8b463d81515448767848a1c1d05d32fd745b7b8cd2ce3766c8
b9f987ef7a0c57a851c20832dbf58883e64ec6e513718b506e20ca2f71c241c8
e2566eb542898662f5a8a5717d7990e988ebaedb2445fe4f3bf0dab166e13e5c
db526cb59caa89c533032cee02b738be48699517a673e8870efa44ef2b8c1eb3
b991288ecd158e84076f7cc38d4ecbcd18cccc580f1971b0dfdd7c88b78e0794

Remediation

Block the threat indicators at their respective controls.

Ensure strict measures against phishing emails.

Rewterz Threat Alert “Beyond The Grave” Virus – Threat Indicators

Rewterz Threat Alert – Threat Actors Targeting Banks Using Tools to Bypass Cyber Security Controls

Rewterz Threat Alert – Threat Actors Targeting Banks Using Tools to Bypass Cyber Security Controls

Security Operations Centers across the region

Saudi Arabia

UAE

Oman

Pakistan