netwire | 7b9a1aa88be62eb638af26146fce0a1b71aec646d2495fb350dd6d56997e7582

Analysis

max time kernel
135s
max time network
135s
platform
windows7_x64
resource
win7
submitted
30-06-2020 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

723e38f58e65b8b7d46131511173e561.exe
Size

680KB
MD5

723e38f58e65b8b7d46131511173e561
SHA1

517710e731f08d0301c3f132d79793f3587a7452
SHA256

7b9a1aa88be62eb638af26146fce0a1b71aec646d2495fb350dd6d56997e7582
SHA512

d84a7dc0639219137c4afd5ec37a0143bd643ebbec188ab50e18965f63e4c2b73b0646c209cdf4052faf67b7a751019b45bb906d0cf58031094c36e5ff5f4b0f

Score

10^/10

rat persistence botnet stealer netwire

Malware Config

Signatures

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2176-126-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/2176-132-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

723e38f58e65b8b7d46131511173e561.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Rsdm = "C:\\Users\\Admin\\AppData\\Local\\Rsdm\\Rsdm.hta"	723e38f58e65b8b7d46131511173e561.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exe

pid process

2240 reg.exe
2256 reg.exe
2312 reg.exe
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

pid	process
2240	reg.exe
2256	reg.exe
2312	reg.exe

Suspicious use of WriteProcessMemory 527 IoCs

Processes:

723e38f58e65b8b7d46131511173e561.exe

description	pid	process	target process
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe
PID 1088 wrote to memory of 1036	1088	723e38f58e65b8b7d46131511173e561.exe	TapiUnattend.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

723e38f58e65b8b7d46131511173e561.exe

description pid process target process

PID 1088 set thread context of 2176 1088 723e38f58e65b8b7d46131511173e561.exe ieinstal.exe
Executes dropped EXE 2 IoCs

Processes:

fodhelper.exefodhelper.exe

pid process

2372 fodhelper.exe
2392 fodhelper.exe

description	pid	process	target process
PID 1088 set thread context of 2176	1088	723e38f58e65b8b7d46131511173e561.exe	ieinstal.exe

pid	process
2372	fodhelper.exe
2392	fodhelper.exe

C:\Users\Admin\AppData\Local\Temp\723e38f58e65b8b7d46131511173e561.exe
"C:\Users\Admin\AppData\Local\Temp\723e38f58e65b8b7d46131511173e561.exe"
1⤵
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1088

C:\Windows\SysWOW64\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
2⤵
PID:1036

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Public\Natso.bat
3⤵
PID:2208

C:\Windows\SysWOW64\reg.exe
reg delete hkcu\Environment /v windir /f
4⤵
- Modifies registry key
PID:2240

C:\Windows\SysWOW64\reg.exe
reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "
4⤵
- Modifies registry key
PID:2256

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
4⤵
PID:2280

C:\Windows\SysWOW64\reg.exe
reg delete hkcu\Environment /v windir /f
4⤵
- Modifies registry key
PID:2312

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Public\Runex.bat
3⤵
PID:2328

C:\Windows \System32\fodhelper.exe
"C:\Windows \System32\fodhelper.exe"
4⤵
- Executes dropped EXE
PID:2372

C:\Windows \System32\fodhelper.exe
"C:\Windows \System32\fodhelper.exe"
4⤵
- Executes dropped EXE
PID:2392

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
2⤵
PID:2176

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Natso.bat

Download Submit
C:\Users\Public\Runex.bat

Download Submit
C:\Users\Public\fodhelper.exe

Download Submit
C:\Users\Public\propsys.dll

Download Submit
C:\Windows \System32\fodhelper.exe

Download Submit
C:\Windows \System32\fodhelper.exe

Download Submit
memory/1036-69-0x0000000000000000-mapping.dmp

Download
memory/1036-30-0x0000000000000000-mapping.dmp

Download
memory/1036-7-0x0000000000000000-mapping.dmp

Download
memory/1036-8-0x0000000000000000-mapping.dmp

Download
memory/1036-9-0x0000000000000000-mapping.dmp

Download
memory/1036-10-0x0000000000000000-mapping.dmp

Download
memory/1036-11-0x0000000000000000-mapping.dmp

Download
memory/1036-12-0x0000000000000000-mapping.dmp

Download
memory/1036-13-0x0000000000000000-mapping.dmp

Download
memory/1036-14-0x0000000000000000-mapping.dmp

Download
memory/1036-15-0x0000000000000000-mapping.dmp

Download
memory/1036-16-0x0000000000000000-mapping.dmp

Download
memory/1036-17-0x0000000000000000-mapping.dmp

Download
memory/1036-18-0x0000000000000000-mapping.dmp

Download
memory/1036-19-0x0000000000000000-mapping.dmp

Download
memory/1036-20-0x0000000000000000-mapping.dmp

Download
memory/1036-21-0x0000000000000000-mapping.dmp

Download
memory/1036-22-0x0000000000000000-mapping.dmp

Download
memory/1036-23-0x0000000000000000-mapping.dmp

Download
memory/1036-24-0x0000000000000000-mapping.dmp

Download
memory/1036-25-0x0000000000000000-mapping.dmp

Download
memory/1036-26-0x0000000000000000-mapping.dmp

Download
memory/1036-27-0x0000000000000000-mapping.dmp

Download
memory/1036-28-0x0000000000000000-mapping.dmp

Download
memory/1036-29-0x0000000000000000-mapping.dmp

Download
memory/1036-72-0x0000000000000000-mapping.dmp

Download
memory/1036-31-0x0000000000000000-mapping.dmp

Download
memory/1036-32-0x0000000000000000-mapping.dmp

Download
memory/1036-33-0x0000000000000000-mapping.dmp

Download
memory/1036-34-0x0000000000000000-mapping.dmp

Download
memory/1036-35-0x0000000000000000-mapping.dmp

Download
memory/1036-36-0x0000000000000000-mapping.dmp

Download
memory/1036-37-0x0000000000000000-mapping.dmp

Download
memory/1036-38-0x0000000000000000-mapping.dmp

Download
memory/1036-39-0x0000000000000000-mapping.dmp

Download
memory/1036-40-0x0000000000000000-mapping.dmp

Download
memory/1036-41-0x0000000000000000-mapping.dmp

Download
memory/1036-42-0x0000000000000000-mapping.dmp

Download
memory/1036-43-0x0000000000000000-mapping.dmp

Download
memory/1036-44-0x0000000000000000-mapping.dmp

Download
memory/1036-45-0x0000000000000000-mapping.dmp

Download
memory/1036-46-0x0000000000000000-mapping.dmp

Download
memory/1036-47-0x0000000000000000-mapping.dmp

Download
memory/1036-48-0x0000000000000000-mapping.dmp

Download
memory/1036-49-0x0000000000000000-mapping.dmp

Download
memory/1036-50-0x0000000000000000-mapping.dmp

Download
memory/1036-51-0x0000000000000000-mapping.dmp

Download
memory/1036-73-0x0000000000000000-mapping.dmp

Download
memory/1036-53-0x0000000000000000-mapping.dmp

Download
memory/1036-54-0x0000000000000000-mapping.dmp

Download
memory/1036-55-0x0000000000000000-mapping.dmp

Download
memory/1036-56-0x0000000000000000-mapping.dmp

Download
memory/1036-57-0x0000000000000000-mapping.dmp

Download
memory/1036-58-0x0000000000000000-mapping.dmp

Download
memory/1036-59-0x0000000000000000-mapping.dmp

Download
memory/1036-60-0x0000000000000000-mapping.dmp

Download
memory/1036-61-0x0000000000000000-mapping.dmp

Download
memory/1036-62-0x0000000000000000-mapping.dmp

Download
memory/1036-63-0x0000000000000000-mapping.dmp

Download
memory/1036-64-0x0000000000000000-mapping.dmp

Download
memory/1036-65-0x0000000000000000-mapping.dmp

Download
memory/1036-66-0x0000000000000000-mapping.dmp

Download
memory/1036-67-0x0000000000000000-mapping.dmp

Download
memory/1036-68-0x0000000000000000-mapping.dmp

Download
memory/1036-5-0x0000000000000000-mapping.dmp

Download
memory/1036-70-0x0000000000000000-mapping.dmp

Download
memory/1036-84-0x0000000000000000-mapping.dmp

Download
memory/1036-6-0x0000000000000000-mapping.dmp

Download
memory/1036-52-0x0000000000000000-mapping.dmp

Download
memory/1036-74-0x0000000000000000-mapping.dmp

Download
memory/1036-75-0x0000000000000000-mapping.dmp

Download
memory/1036-76-0x0000000000000000-mapping.dmp

Download
memory/1036-77-0x0000000000000000-mapping.dmp

Download
memory/1036-78-0x0000000000000000-mapping.dmp

Download
memory/1036-79-0x0000000000000000-mapping.dmp

Download
memory/1036-80-0x0000000000000000-mapping.dmp

Download
memory/1036-81-0x0000000000000000-mapping.dmp

Download
memory/1036-82-0x0000000000000000-mapping.dmp

Download
memory/1036-83-0x0000000000000000-mapping.dmp

Download
memory/1036-71-0x0000000000000000-mapping.dmp

Download
memory/1036-85-0x0000000000000000-mapping.dmp

Download
memory/1036-86-0x0000000000000000-mapping.dmp

Download
memory/1036-87-0x0000000000000000-mapping.dmp

Download
memory/1036-88-0x0000000000000000-mapping.dmp

Download
memory/1036-89-0x0000000000000000-mapping.dmp

Download
memory/1036-90-0x0000000000000000-mapping.dmp

Download
memory/1036-91-0x0000000000000000-mapping.dmp

Download
memory/1036-92-0x0000000000000000-mapping.dmp

Download
memory/1036-93-0x0000000000000000-mapping.dmp

Download
memory/1036-94-0x0000000000000000-mapping.dmp

Download
memory/1036-95-0x0000000000000000-mapping.dmp

Download
memory/1036-96-0x0000000000000000-mapping.dmp

Download
memory/1036-97-0x0000000000000000-mapping.dmp

Download
memory/1036-98-0x0000000000000000-mapping.dmp

Download
memory/1036-99-0x0000000000000000-mapping.dmp

Download
memory/1036-100-0x0000000000000000-mapping.dmp

Download
memory/1036-101-0x0000000000000000-mapping.dmp

Download
memory/1036-102-0x0000000000000000-mapping.dmp

Download
memory/1036-103-0x0000000000000000-mapping.dmp

Download
memory/1036-104-0x0000000000000000-mapping.dmp

Download
memory/1036-105-0x0000000000000000-mapping.dmp

Download
memory/1036-106-0x0000000000000000-mapping.dmp

Download
memory/1036-107-0x0000000000000000-mapping.dmp

Download
memory/1036-108-0x0000000000000000-mapping.dmp

Download
memory/1036-109-0x0000000000000000-mapping.dmp

Download
memory/1036-110-0x0000000000000000-mapping.dmp

Download
memory/1036-111-0x0000000000000000-mapping.dmp

Download
memory/1036-112-0x0000000000000000-mapping.dmp

Download
memory/1036-113-0x0000000000000000-mapping.dmp

Download
memory/1036-114-0x0000000000000000-mapping.dmp

Download
memory/1036-115-0x0000000000000000-mapping.dmp

Download
memory/1036-116-0x0000000000000000-mapping.dmp

Download
memory/1036-117-0x0000000000000000-mapping.dmp

Download
memory/1036-118-0x0000000000000000-mapping.dmp

Download
memory/1036-119-0x0000000000000000-mapping.dmp

Download
memory/1036-120-0x0000000000000000-mapping.dmp

Download
memory/1036-121-0x0000000000000000-mapping.dmp

Download
memory/1036-122-0x0000000000000000-mapping.dmp

Download
memory/1036-123-0x0000000000000000-mapping.dmp

Download
memory/1036-125-0x0000000000000000-mapping.dmp

Download
memory/1036-0-0x0000000000000000-mapping.dmp

Download
memory/1036-1-0x0000000000000000-mapping.dmp

Download
memory/1036-2-0x0000000000000000-mapping.dmp

Download
memory/1036-3-0x0000000000000000-mapping.dmp

Download
memory/1036-4-0x0000000000000000-mapping.dmp

Download
memory/1088-124-0x0000000010410000-0x0000000010450000-memory.dmp

Filesize
256KB

Download
memory/2176-132-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2176-130-0x000000000040242D-mapping.dmp

Download
memory/2176-126-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2208-127-0x0000000000000000-mapping.dmp

Download
memory/2240-129-0x0000000000000000-mapping.dmp

Download
memory/2256-131-0x0000000000000000-mapping.dmp

Download
memory/2280-133-0x0000000000000000-mapping.dmp

Download
memory/2312-134-0x0000000000000000-mapping.dmp

Download
memory/2328-135-0x0000000000000000-mapping.dmp

Download