• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Advisory – ICS: Multiple Siemens Products Security Vulnerabilities
June 10, 2020
Rewterz Threat Alert – Metamorfo Campaign Targeting Banking Customers
June 10, 2020

Rewterz Threat Alert – Netwire RAT Malware

June 10, 2020

Severity

High

Analysis Summary

A Netwire campaign targeting Italian industry. As the Netwire variant was common to known samples, the main focus of their reporting on the subject was the unique attack chain used to distribute the RAT. The campaign begins with an Italian language email and XLS attachment. This XLS attachment contains a macro that kicks off the infection chain if a user opts to enable macros. This macro simply downloads what appears to be an image file but instead is an XSL stylesheet containing JavaScript. The contained JavaScript downloads and executes a VBS file hosted on the same server as the fake image file. In turn, the VBS code fetches yet another payload from the remote server. This payload is downloaded as a .jpg and read by the VBS code as raw bytes that will eventually become executable PowerShell code. The PowerShell code provides two functions. First, it loads a DLL that can perform an AMSI bypass. Then, it loads a second DLL that can inject the Netwire payload into another process. Persistence is established via a Registry Run key. As mentioned, the final payload is the Netwire RAT, which provides attackers with the ability to steal information from victim machines, such as credentials, browser history, and keystrokes. The researchers note that similarities exist between the naming conventions of variables in the payloads from this campaign with those in Aggah campaigns targeting the Italian manufacturing industry. 

0f-2XMV7loNQ61rvu4m8JIPL0-iGJxiNc4R5PJ_X8LuRSYTjn1THYpE5Tw-9FTbNGHOQ9mZ8z6sa3g7TA71saBVsaa-cpjuBRLqgBDPSUr1kQjFomVVgdLvI2PaSKKR6HRZS2qQ

Impact

  • Information theft
  • Exposure of sensitive data

Indicators of Compromise

MD5

  • ce7b8394cdc66149f91ed39ce6c047ee
  • 4e4001c6c47d09009eb24ce636bf5906
  • 4b8e4d05092389216f947e980ac8a7b9
  • ad066878659d1f2d0aee06546d3e500b
  • ebe4a3f4ceb6d8f1a0485e3ce4333a7c

SHA-256

  • b7e95d0dcedd77ab717a33163af23ab2fd2dc6d07cdf81c5e4cfe080b0946b79
  • 818fa737f4041136cde620c3fa3bac5124f60506ef1a64bbc2f8472218039db5
  • 48d9c8293d94c851dec10832b2ef6800dc91669e8fef96d8763d17d6b225e42c

SHA1

  • 2e0003aeda533f10ef3a69cb6217dbc1da980b9e
  • 42b1a3e7891c78f026a9773fad96931ebf8e08cf
  • fb7f0880acc174e0c89728783c348cba69315b08

Remediation

  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the links/attachments sent by unknown senders.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.