NetWiredRC

We could not confirm the delivery vector of this downloader but in we suspect the use of spam emails and cracked software as we have seen in earlier campaigns.

Upon receipt of a command from the server, a single function is called to decrypt the payload data and execute the received instruction.

20 start remote shell 21 write into WritePipe 22 reset tid for remote shell 22 (r) terminated remote shell 23 (r) failed to start remote shell

%AppData%\Microsoft\Crypto\Office.exe Filename when made persistent... HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run value:Office data:%AppData%\Microsoft\Crypto\Office.exe

%AppData%\Microsoft\Crypto\Office.exe Filename when made persistent... HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run value:Office data:%AppData%\Microsoft\Crypto\Office.exe

After an anti-emulation stage, stage 2 decrypts the final malware, using the key 0x5A4C4D4D4C4D... From the memory segment the code has been decrypted to, it is being written back to the .text section.

After an anti-emulation stage, stage 2 decrypts the final malware... String Use VM Vmware check?

hMutex = CreateMutexA(0, 1, “mJhcimNA”)

$klg1 = "[Backspace]" ... $klg20 = "[Ctrl+%c]"

31 set mouse button press 32 set cursor position

3D fetch and send stored credentials, history and certificates from common browsers

Netwired’s main focus is to gain unauthorized control on the victim machine, steal stored credentials...

24 collect client information and configuration ... 26 get logged on users 26 (r) send logged on users

28 get detailed process information 29 (r) failed to get detailed process information

T1082 System Information Discovery Quasar and NETWIRE both RAT having this feature to discover and collect victim machine information.

10 locate and send file with time, attributes and size 12 find file ... 36 locate and send file from log directory with time, attributes and size 38 check if log file exists

After an anti-emulation stage, stage 2 decrypts the final malware... String Use VM Vmware check?

hMutex = CreateMutexA(0, 1, “mJhcimNA”)

$klg1 = "[Backspace]" ... $klg20 = "[Ctrl+%c]"

31 set mouse button press 32 set cursor position

T1113 Screen Capture Mentioned RAT functionality

44 get audio devices and formats ... 46 start audio recording ... 48 stop audio recording

T1125 Video Capture Mentioned RAT functionality

NetWire uses a custom, TCP-based protocol.

D threaded: get file over HTTP and execute ... 2D get file over HTTP and execute

43 socks_proxy

NetWire uses a custom, TCP-based protocol.

The infection starts with the delivery of a downloader that downloads multiple payloads... Once the attackers achieve initial compromise, the downloader downloads three files... A Pyrome python backdoor is downloaded by this shellcode. This will also download socat and xmrig miner, and finally xmrig miner downloads another RAT named Quasar.

The payload hosted on pastebin is encoded in base64 with the text string reversed... The payloads are also similarly string reversed after base64 encoding.

maltype = "Remote Access Trojan"

The producer of the NetWire WorldWiredLabs, states that the tool uses 256-bit AES encryption, which we found to be accurate.