General

  • Target

    New-Order December 11.xlsx

  • Size

    2.5MB

  • Sample

    201211-yx818t5rx2

  • MD5

    a2dda60747929ba6108e26f0c74aa977

  • SHA1

    dd9ee815a020b8fccc0802f517434fedc74f2df2

  • SHA256

    9bf04019aed8fe1f074fed2b8b14eac046d7efdd0721e178b1695df05de97521

  • SHA512

    9add2efbecfcb10b7b565cb6c6db8433acc8afdde57e118c3c6b75fbbf3b57441294210d7269303d3cd046109669283e7cd7ab0762a35b4070bfde2434dceebc

Malware Config

Targets

    • Target

      New-Order December 11.xlsx

    • Size

      2.5MB

    • MD5

      a2dda60747929ba6108e26f0c74aa977

    • SHA1

      dd9ee815a020b8fccc0802f517434fedc74f2df2

    • SHA256

      9bf04019aed8fe1f074fed2b8b14eac046d7efdd0721e178b1695df05de97521

    • SHA512

      9add2efbecfcb10b7b565cb6c6db8433acc8afdde57e118c3c6b75fbbf3b57441294210d7269303d3cd046109669283e7cd7ab0762a35b4070bfde2434dceebc

    • NetWire RAT payload

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    • Looks for VirtualBox Guest Additions in registry

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Looks for VMWare Tools registry key

    • Modifies Installed Components in the registry

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Registry Run Keys / Startup Folder

2
T1060

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Modify Registry

3
T1112

Scripting

1
T1064

Discovery

Query Registry

6
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Tasks