MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e76bd502c91158631cadf485ce44caa4d6504864735593fc23d90477a794d17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 6


Maldoc score: 7


Intelligence 6 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e76bd502c91158631cadf485ce44caa4d6504864735593fc23d90477a794d17
SHA3-384 hash: 5c6147733f041cf793981c5f7da4e528a21453b87bb711b2944ae729fe1f5dbfd4403f9df5b38af22cb44da33547f37b
SHA1 hash: ea7b59dde9f0600915069dec66f8410f25cb66fd
MD5 hash: 55db711144ff4a35faf58d982e7cf727
humanhash: tennessee-delta-sad-kilo
File name:Proforma Invoice.xls
Download: download sample
Signature NetWire
Create hunting rule
File size:76'288 bytes
First seen:2020-11-19 08:19:37 UTC
Last seen:Never
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 1536:/pqnSGiysRchNXHfA1MiWhZFGkElMFAAr7IQmSb4wIE7zp0RhBv1hQz7rTb16mL:/4nSGiysRchNXHfA1MiWhZFGkElMFAAv
TLSH 92736C417B51C881E6164B324EE3975A6723FC618EBB870B3109F36E2E77DA0DA0355B
Reporter ffforward
Tags:NetWire xls

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 7
Application name is Microsoft Excel
Office document is in OLE format
Office document contains VBA Macros
OLE dump

MalwareBazaar was able to identify 15 sections in this file using oledump:

Section IDSection sizeSection name
1115 bytesCompObj
2296 bytesDocumentSummaryInformation
3224 bytesSummaryInformation
461163 bytesWorkbook
5533 bytes_VBA_PROJECT_CUR/PROJECT
686 bytes_VBA_PROJECT_CUR/PROJECTwm
7977 bytes_VBA_PROJECT_CUR/VBA/Feuil1
81512 bytes_VBA_PROJECT_CUR/VBA/Module1
9985 bytes_VBA_PROJECT_CUR/VBA/ThisWorkbook
102607 bytes_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
111136 bytes_VBA_PROJECT_CUR/VBA/__SRP_0
1274 bytes_VBA_PROJECT_CUR/VBA/__SRP_1
1384 bytes_VBA_PROJECT_CUR/VBA/__SRP_2
14103 bytes_VBA_PROJECT_CUR/VBA/__SRP_3
15568 bytes_VBA_PROJECT_CUR/VBA/dir
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecauto_openRuns when the Excel Workbook is opened
IOCvx.exeExecutable file name
SuspiciousRunMay run an executable file or a system command
SuspiciousEXECMay run an executable file or a system
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
1
# of downloads :
354
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilDoc.SUPExcel4MacroVines.201109.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a process with a hidden window
Launching a process
DNS request
Sending a custom TCP request
Running batch commands by exploiting the app vulnerability
Result
Gathering data
Result
Threat name:
Hidden Macro 4.0
Create hunting rule
Detection:
malicious
Classification:
expl.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/542557
Signature
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Document contains an embedded VBA macro which may execute processes
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Found obfuscated Excel 4.0 Macro
Multi AV Scanner detection for submitted file
Obfuscated command line found
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Sigma detected: Microsoft Office Product Spawning Windows Shell
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 320373 Sample: Proforma Invoice.xls Startdate: 19/11/2020 Architecture: WINDOWS Score: 92 28 Antivirus detection for URL or domain 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) 2->32 34 6 other signatures 2->34 7 EXCEL.EXE 85 30 2->7         started        process3 signatures4 36 Obfuscated command line found 7->36 38 Document exploit detected (process start blacklist hit) 7->38 10 cmd.exe 7->10         started        13 cmd.exe 7->13         started        15 cmd.exe 7->15         started        process5 signatures6 40 Obfuscated command line found 10->40 17 powershell.exe 16 9 10->17         started        20 powershell.exe 7 13->20         started        22 powershell.exe 7 15->22         started        process7 dnsIp8 24 cutt.ly 104.22.0.232, 443, 49165 CLOUDFLARENETUS United States 17->24 26 shopphongtinh.com 202.92.6.10, 443, 49167, 49168 VNPT-AS-VNVNPTCorpVN Viet Nam 17->26
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e76bd502c91158631cadf485ce44caa4d6504864735593fc23d90477a794d17/
Threat name:
Document-Word.Trojan.Hedmeta
Create hunting rule
Status:
Malicious
First seen:
2020-11-19 08:20:08 UTC
File Type:
Document
Extracted files:
23
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nz3l2ubmsekymmok35efzzcmvjgwkbegi42vsp6chwieo6tzjulq._file
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet macro persistence rat stealer
Link:
https://tria.ge/reports/201119-r92d5yaqye/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Checks processor information in registry
Office loads VBA resources, possible macro or embedded object present
Suspicious use of SetThreadContext
Adds Run key to start application
Blacklisted process makes network request
Executes dropped EXE
Process spawned unexpected child process
NetWire RAT payload
Netwire
Malware Config
Dropper Extraction:
https://cutt.ly/ZhqUH1O
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples
Rule name:UAC_bypass_bin_mem
Create hunting rule
Author:James_inthe_box
Description:UAC bypass in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

Excel file xls 6e76bd502c91158631cadf485ce44caa4d6504864735593fc23d90477a794d17

(this sample)

  
Link
https://tria.ge/201119-ntzbxnaqla
  
Delivery method
Distributed via e-mail attachment

Comments