netwire | 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f

Analysis

max time kernel
131s
max time network
83s
platform
windows10_x64
resource
win10v200430
submitted
24/06/2020, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe
Size 223KB
Sample200624-xmvsdeer76
SHA256 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f
MD5 58dd12db0aa525a52efbb4ebbb00a397
SHA1 6ee3dc0ada96ac9c8dd516c27f485189e45d3f9f
SHA512 1741aaddd3a25aab64f758cd68f9b9ddcf8863da0bdb96cd507eba69862de7cabd87c39cd2c151e7274a95559b78b49954542dab895e572346ba9a57928f2d27
MD5 SHA1 SHA512

Score

10^/10

rat botnet stealer netwire

Malware Config

Signatures

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe
2460	WerFault.exe
2460	WerFault.exe
2460	WerFault.exe
2460	WerFault.exe
2460	WerFault.exe
2460	WerFault.exe
2460	WerFault.exe
2460	WerFault.exe
2460	WerFault.exe
2460	WerFault.exe
2460	WerFault.exe
2460	WerFault.exe
2460	WerFault.exe
1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe
1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe
1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1160	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	69
PID 1908 wrote to memory of 1160	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	69
PID 1908 wrote to memory of 1160	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	69
PID 1908 wrote to memory of 1160	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	69
PID 1908 wrote to memory of 1160	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	69
PID 1908 wrote to memory of 1160	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	69
PID 1908 wrote to memory of 1160	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	69
PID 1908 wrote to memory of 1160	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	69
PID 1908 wrote to memory of 1160	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	69
PID 1908 wrote to memory of 1160	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	69
PID 1908 wrote to memory of 2868	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	72
PID 1908 wrote to memory of 2868	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	72
PID 1908 wrote to memory of 2868	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	72
PID 1908 wrote to memory of 2224	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	74
PID 1908 wrote to memory of 2224	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	74
PID 1908 wrote to memory of 2224	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	74
PID 2224 wrote to memory of 3944	2224	cmd.exe	76
PID 2224 wrote to memory of 3944	2224	cmd.exe	76
PID 2224 wrote to memory of 3944	2224	cmd.exe	76
PID 1908 wrote to memory of 360	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	77
PID 1908 wrote to memory of 360	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	77
PID 1908 wrote to memory of 360	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	77
PID 1908 wrote to memory of 800	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	79
PID 1908 wrote to memory of 800	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	79
PID 1908 wrote to memory of 800	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	79
PID 800 wrote to memory of 756	800	cmd.exe	81
PID 800 wrote to memory of 756	800	cmd.exe	81
PID 800 wrote to memory of 756	800	cmd.exe	81

Executes dropped EXE 1 IoCs

pid	Process
1160	svhost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier	cmd.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
756	timeout.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe
Token: SeRestorePrivilege	2460	WerFault.exe
Token: SeBackupPrivilege	2460	WerFault.exe
Token: SeDebugPrivilege	2460	WerFault.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1908 set thread context of 1160	1908	894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe	69

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2460	1160	WerFault.exe	69

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/1160-3-0x0000000000620000-0x0000000000650000-memory.dmp	netwire
behavioral2/memory/1160-4-0x0000000000620000-0x0000000000650000-memory.dmp	netwire

C:\Users\Admin\AppData\Local\Temp\894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe
"C:\Users\Admin\AppData\Local\Temp\894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1908
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  PID:1160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 484
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Program crash
    PID:2460
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe" "%temp%\FolderN\name.exe" /Y
  2⤵
  PID:2868
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f
    3⤵
    PID:3944
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
  2⤵
  - NTFS ADS
  PID:360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 300
    3⤵
    - Delays execution with timeout.exe
    PID:756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1160-4-0x0000000000620000-0x0000000000650000-memory.dmp

Download

memory/1160-3-0x0000000000620000-0x0000000000650000-memory.dmp

Download

memory/2460-5-0x00000000049C0000-0x00000000049C1000-memory.dmp

Download

memory/2460-12-0x00000000050F0000-0x00000000050F1000-memory.dmp

Download