SHADOW-WATER-084 IoCs ==================================================================================================================================================== File Role Indicator ==================================================================================================================================================== Campaign 1: BubbleLevel to packed native stub YoOC.exe Decoy 38844b04746f881856b293f859dab2cfc067312c86f7c8d2b9698f8955cdd18d SystemSafe.dll Stage 1 47a856ff7d9bf14949f9a1deed4ba4ec9495a9ef95ee41ba6d78f630561d166c WinTune.dll GraftLoader 1085dc1b31c94ef9839fa4922b9c44404f54db048b213064be775b5d14fb5f1e dump.bin Final payload 5fc93c19290f66365b0f6f43c7a506d17dc2853f0018a01e49aaa324c2fee375 chz2n4005zp.ps1 Persistence script 2a10802d86d98099f40ef4fbd079461b00830d103c39609eb34d1d5d78b1cef1 Campaign 2: CardGame to Remcos RAT 7.2.5 Pro wWLCxH.exe Decoy 737646392a7c882064e22ecb9fc0b2732399e44ced2f56d873e656d0035af288 SystemPuzzle.dll Stage 1 cb6f45003cc1e1547e8e377bdd8e9a15445119e9b610969d7b857e84722e1d59 System Optimizer Ultimate.dll GraftLoader 5bf218bc4ad1acdb1cdace2eb680af129d862bd1cca7897837e992cf09872d6e remcos.bin Final payload 808a02060e1ba1cc125fcc3dbcc7416e5955a575378a537d7bb276d0ec4932cb 2p1qkqquesx.ps1 Persistence script f58ab607f825c669de335d0aae6f5d98cc8df5ddd66e7697d0985b1e5ee17e61 Campaign 3: CellularAutomaton to LXBASE VldL.exe Decoy 56fc01565bd2f721362f464d249c50125bfddf6c89c63d9681c88f70cc83e7a6 SystemPuzzle.dll Stage 1 9b7b864b1e026793db7fe15147751249b43d26caeaa90537a9dc4b4cd29c8a35 Edge Optimizer.dll GraftLoader 791d1359cb62d8b8177913710a6b07fc8289ad5f4e14908b3b178593df597c6c LX_PYLD_FED77E72.exe Final payload 005b34cd35534aa697f23faabcba9063fe744f80f4e150ed77e2833c44a303f6 4nwsb3sor1s.ps1 Persistence script f2c784ad47d067d78ae8f8071ae8feebeb5602c0827db2a576235cc4588e459e ==================================================================================================================================================== Network and host indicators ==================================================================================================================================================== Type IPv4 and port 84[.]38[.]129[.]31:8085 Remcos command and control, Campaign 2 IPv4 and port 84[.]38[.]129[.]31:9095 Remcos command and control, Campaign 2 Campaign tag Rmc-T423KN Remcos configuration identifier Mutex LAdbxOOmmJSBbFgGueO GraftLoader watchdog mutex, Campaign 2 File path %APPDATA%\IVLllIrsaR.exe Persistence copy, Campaign 1 File path %APPDATA%\wWLCxH.exe Persistence copy, Campaign 2 File path %APPDATA%\YGqlCAFGaLidSU.exe Persistence copy, Campaign 3 File path %TEMP%\.ps1 Dropped launcher, all campaigns File path C:\Windows\Temp\.inf CMSTP profile, Campaign 2 String CorpVPN Service and short service name in the INF template String This section contains additional comments to increase file size INF padding block Resource name aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources Orphaned designer resource, identical across all protected loaders Module name msasn1.dll Name used by the LXBASE browser helper stub