netwire | 77642de174198cae37f2b0ce29eb087f138800df44a79bd0e589962e9fc64e36

Resubmissions

29-05-2020 15:48

200529-1srcc11mvs 10

18-05-2020 13:05

200518-5aex7b1s12 5

Analysis

max time kernel
139s
max time network
141s
platform
windows10_x64
resource
win10v200430
submitted
29-05-2020 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fw_CONFIRMATION_OF_BALANCES-AP20.exe
Size

476KB
MD5

8a522b7dfd76a91312ea31b4e827b4a0
SHA1

0754d2176df167f3e46d397f87ca3834cd89dee7
SHA256

77642de174198cae37f2b0ce29eb087f138800df44a79bd0e589962e9fc64e36
SHA512

1c82a4d893cfde8eedd9141d8ee83cccb752e9ccf1b89cbf5d3d9c9c655e1440548784eb8af82775b0930fdce137335f4bf084f63643052fa0523791bc2192b0

Score

10^/10

rat botnet stealer netwire

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Fw_CONFIRMATION_OF_BALANCES-AP20.exe

description	pid	process	target process
PID 640 wrote to memory of 1820	640	Fw_CONFIRMATION_OF_BALANCES-AP20.exe	schtasks.exe
PID 640 wrote to memory of 1820	640	Fw_CONFIRMATION_OF_BALANCES-AP20.exe	schtasks.exe
PID 640 wrote to memory of 1820	640	Fw_CONFIRMATION_OF_BALANCES-AP20.exe	schtasks.exe
PID 640 wrote to memory of 2112	640	Fw_CONFIRMATION_OF_BALANCES-AP20.exe	Fw_CONFIRMATION_OF_BALANCES-AP20.exe
PID 640 wrote to memory of 2112	640	Fw_CONFIRMATION_OF_BALANCES-AP20.exe	Fw_CONFIRMATION_OF_BALANCES-AP20.exe
PID 640 wrote to memory of 2112	640	Fw_CONFIRMATION_OF_BALANCES-AP20.exe	Fw_CONFIRMATION_OF_BALANCES-AP20.exe
PID 640 wrote to memory of 2112	640	Fw_CONFIRMATION_OF_BALANCES-AP20.exe	Fw_CONFIRMATION_OF_BALANCES-AP20.exe
PID 640 wrote to memory of 2112	640	Fw_CONFIRMATION_OF_BALANCES-AP20.exe	Fw_CONFIRMATION_OF_BALANCES-AP20.exe
PID 640 wrote to memory of 2112	640	Fw_CONFIRMATION_OF_BALANCES-AP20.exe	Fw_CONFIRMATION_OF_BALANCES-AP20.exe
PID 640 wrote to memory of 2112	640	Fw_CONFIRMATION_OF_BALANCES-AP20.exe	Fw_CONFIRMATION_OF_BALANCES-AP20.exe
PID 640 wrote to memory of 2112	640	Fw_CONFIRMATION_OF_BALANCES-AP20.exe	Fw_CONFIRMATION_OF_BALANCES-AP20.exe
PID 640 wrote to memory of 2112	640	Fw_CONFIRMATION_OF_BALANCES-AP20.exe	Fw_CONFIRMATION_OF_BALANCES-AP20.exe
PID 640 wrote to memory of 2112	640	Fw_CONFIRMATION_OF_BALANCES-AP20.exe	Fw_CONFIRMATION_OF_BALANCES-AP20.exe
PID 640 wrote to memory of 2112	640	Fw_CONFIRMATION_OF_BALANCES-AP20.exe	Fw_CONFIRMATION_OF_BALANCES-AP20.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Fw_CONFIRMATION_OF_BALANCES-AP20.exe

description pid process target process

PID 640 set thread context of 2112 640 Fw_CONFIRMATION_OF_BALANCES-AP20.exe Fw_CONFIRMATION_OF_BALANCES-AP20.exe

description	pid	process	target process
PID 640 set thread context of 2112	640	Fw_CONFIRMATION_OF_BALANCES-AP20.exe	Fw_CONFIRMATION_OF_BALANCES-AP20.exe

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2112-1-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/2112-2-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1820 schtasks.exe
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

pid	process
1820	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\Fw_CONFIRMATION_OF_BALANCES-AP20.exe
"C:\Users\Admin\AppData\Local\Temp\Fw_CONFIRMATION_OF_BALANCES-AP20.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:640

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TxUtzXBT" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDA7C.tmp"
2⤵
- Creates scheduled task(s)
PID:1820

C:\Users\Admin\AppData\Local\Temp\Fw_CONFIRMATION_OF_BALANCES-AP20.exe
"{path}"
2⤵
PID:2112

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpDA7C.tmp

Download Submit
memory/2112-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2112-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download