MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1cb6321f2ebbbb2f5a02ebc78f70dcfbc182be63660f8fa4da9ea0b8048d3f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 13


Maldoc score: 17


Intelligence 13 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b1cb6321f2ebbbb2f5a02ebc78f70dcfbc182be63660f8fa4da9ea0b8048d3f3
SHA3-384 hash: 1dd2842835ae44c755c6748c4aac40a18e8367453689c58f402fb1077adcc580c5a5db12bd2e008f478bcdb8233b5fd7
SHA1 hash: dfa9ee8666792610e933f37ef4b809d105bd6d0b
MD5 hash: bb56560a5d74605f66f9a79024ff36a8
humanhash: cola-mike-eleven-victor
File name:invoice_PO_67765.xlsm
Download: download sample
Signature NetWire
Create hunting rule
File size:43'153 bytes
First seen:2023-01-23 18:42:31 UTC
Last seen:Never
File type:Excel file xlsm
MIME type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep 768:QXvjYuvKssnZCFmBIJYfTH+niSpGvDHrNv+nWhFFiKk/fXqtZ1rhRF+nw3Y:UvPvKTcmG1B2TrNv+GFFi3/vqP9hew3Y
TLSH T16613D02CCF89ED34DA5F9074D91FA5A1469B99918291DF870E2CE20A15C9C80533BEBF
TrID 42.2% (.XLAM) Excel Macro-enabled Open XML add-in (83500/1/13)
29.1% (.XLSM) Excel Microsoft Office Open XML Format document (with Macro) (57500/1/12)
17.2% (.XLSX) Excel Microsoft Office Open XML Format document (34000/1/7)
8.8% (.ZIP) Open Packaging Conventions container (17500/1/4)
2.0% (.ZIP) ZIP compressed archive (4000/1)
Reporter abuse_ch
Tags:NetWire xlsm


Avatar
abuse_ch
Payload URLs:
http://198.23.172.90/invoice12.exe
http://198.23.172.90/Jhlkmpk.dll

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 17
OLE dump

MalwareBazaar was able to identify 8 sections in this file using oledump:

Section IDSection sizeSection name
A1537 bytesPROJECT
A292 bytesPROJECTwm
A3173 bytesVBA/Learn more
A4168 bytesVBA/Start
A5631 bytesVBA/ThisWorkbook
A67 bytesVBA/_VBA_PROJECT
A7251 bytesVBA/dir
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecWorkbook_OpenRuns when the Excel Workbook is opened
IOC198.23.172.90IPv4 address
IOCinvoice12.exeExecutable file name
SuspiciousShellMay run an executable file or a system command
SuspiciousWScript.ShellMay run an executable file or a system command
SuspiciouspowershellMay run PowerShell commands
SuspiciousexecutionpolicyMay run PowerShell commands
SuspiciousStart-ProcessMay run an executable file or a system command using PowerShell
SuspiciousCreateObjectMay create an OLE object
SuspiciousExecMay run an executable file or a system
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
1
# of downloads :
259
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
netwire
Create hunting rule
ID:
1
File name:
invoice_PO_67765.xlsm
Verdict:
Malicious activity
Analysis date:
2023-01-23 18:44:20 UTC
Tags:
macros macros-on-open trojan loader netwire
Link:
https://app.any.run/tasks/beda4aaf-f8b3-4b62-9e98-1865825d4ff6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
File type:
application/vnd.ms-excel.sheet.macroEnabled.12
Has a screenshot:
False
Contains macros:
True
Detection:
NetWire
Create hunting rule
Link:
https://www.capesandbox.com/analysis/356029/
Detection(s):
SecuriteInfo.com.Office.Macro-13.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.PublicDottedQuadDLrRunLikeHell.20210223.UNOFFICIAL
Create hunting rule

Xls.Dropper.EPPlus-9802867-2
Create hunting rule

TwinWave.EvilDoc.OkayLureDefenderXL.20220418.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Creating a window
Сreating synchronization primitives
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process from a recently created file
Changing an executable file
Launching a process
Creating a process with a hidden window
Unauthorized injection to a recently created process
Launching a process by exploiting the app vulnerability
Infecting executable files
Result
Verdict:
Malicious
File Type:
Excel File with Macro
Link:
https://app.docguard.net/b1cb6321f2ebbbb2f5a02ebc78f70dcfbc182be63660f8fa4da9ea0b8048d3f3/results/dashboard
Payload URLs
URL
File name
198.23.172.90
ThisWorkbook
Behaviour
BlacklistAPI detected
Document image
Image:
Download PNG
Document image
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
macros macros-on-open
Link:
https://www.filescan.io/uploads/63ced537416d38777a79f26f/reports/70fe0051-3c26-475c-9529-b7d1f296ff80/overview
Label:
Malicious
Suspicious Score:
9.4/10
Score Malicious:
95%
Score Benign:
5%
Link:
https://www.malware.ai/gui/files/?id=887b00e4-aa6c-40e5-a4b7-c600c05cf7be
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/b1cb6321f2ebbbb2f5a02ebc78f70dcfbc182be63660f8fa4da9ea0b8048d3f3
Details
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
IPv4 Dotted Quad URL
A URL was detected referencing a direct IP address, as opposed to a domain name.
Hidden Powershell
Detected a pivot to Powershell that utilizes commonly nefarious attributes such as '-windowstyle hidden'.
Powershell in Macro
Detected a macro that may utilize Powershell. Such pivots are commonly found in malware.
Macro Contains Suspicious String
Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...
Malicious Scriptlet 7 of 7
Detected a malicious pivot typically seen during the 'file-less' pivot commonly seen in malware carriers.
External Relationship Element
Document contains an externally hosted relationship, which fetches further content.
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
expl.evad.troj.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1157479
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Contains functionality to steal Chrome passwords or cookies
Creates an undocumented autostart registry key
Document contains an embedded VBA macro with suspicious strings
Document exploit detected (process start blacklist hit)
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Sigma detected: NetWire
Snort IDS alert for network traffic
Suspicious powershell command line found
Yara detected Costura Assembly Loader
Yara detected Netwire RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 790215 Sample: invoice_PO_67765.xlsm Startdate: 23/01/2023 Architecture: WINDOWS Score: 100 40 Snort IDS alert for network traffic 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 Antivirus detection for URL or domain 2->44 46 15 other signatures 2->46 9 EXCEL.EXE 26 29 2->9         started        process3 signatures4 56 Suspicious powershell command line found 9->56 12 powershell.exe 15 20 9->12         started        process5 dnsIp6 38 198.23.172.90, 49700, 49701, 80 AS-COLOCROSSINGUS United States 12->38 34 C:\Users\user\AppData\Local\...\tmpD703.exe, PE32 12->34 dropped 58 Powershell drops PE file 12->58 17 tmpD703.exe 14 6 12->17         started        21 conhost.exe 12->21         started        file7 signatures8 process9 file10 32 C:\Users\user\AppData\Roaming\...\mgrser.exe, PE32 17->32 dropped 48 Multi AV Scanner detection for dropped file 17->48 50 Creates an undocumented autostart registry key 17->50 52 Machine Learning detection for dropped file 17->52 54 3 other signatures 17->54 23 tmpD703.exe 2 17->23         started        26 powershell.exe 13 17->26         started        28 tmpD703.exe 17->28         started        signatures11 process12 dnsIp13 36 212.193.30.230, 3363 SPD-NETTR Russian Federation 23->36 30 conhost.exe 26->30         started        process14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b1cb6321f2ebbbb2f5a02ebc78f70dcfbc182be63660f8fa4da9ea0b8048d3f3/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=whfwgips5o53f5naf26hr5ynz66bqk7ggzqpr6snvhvaxaci2pzq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
macro
Link:
https://tria.ge/reports/230123-xcwydsgc7w/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Office loads VBA resources, possible macro or embedded object present
Blocklisted process makes network request
Process spawned unexpected child process
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b1cb6321f2eb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b1cb6321f2ebbbb2f5a02ebc78f70dcfbc182be63660f8fa4da9ea0b8048d3f3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:informational_win_ole_protected
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Identify OLE Project protection within documents.
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:vbaproject_bin
Create hunting rule
Author:CD_R0M_
Description:{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
URLhaus
https://urlhaus.abuse.ch/host/198.23.172.90/
Cape
Cape
https://www.capesandbox.com/analysis/356029/

Comments