netwire | a521bd7e14bd3f373c03a13487b5ec4156c9b59bcf7751db5b6fded58d4825d3

Analysis

max time kernel
137s
max time network
149s
platform
windows10_x64
resource
win10v200430
submitted
07/07/2020, 08:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bank_details.exe
Size

2.7MB
MD5

9b878d9209ed90815bc3bc06a842dd4c
SHA1

84b95b2e05bb14212c6688d4a82486bc1932dae6
SHA256

a521bd7e14bd3f373c03a13487b5ec4156c9b59bcf7751db5b6fded58d4825d3
SHA512

09171d02e63504a6b84ab9b7c10f38ad2f3792c3a0ddbf4d9268edc3ee85a90c5c2cff675683577a20a93432eb63ebd079286ddb6c8e470da82799aa32277f9a

Score

10^/10

persistence botnet stealer netwire

Malware Config

Signatures

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 4032	652	Bank_details.exe	69
PID 652 wrote to memory of 4032	652	Bank_details.exe	69
PID 652 wrote to memory of 4032	652	Bank_details.exe	69
PID 652 wrote to memory of 4032	652	Bank_details.exe	69
PID 652 wrote to memory of 4032	652	Bank_details.exe	69

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 652 set thread context of 4032	652	Bank_details.exe	69

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Imjz = "C:\\Users\\Admin\\AppData\\Local\\Imjz\\Imjz.hta"	Bank_details.exe

C:\Users\Admin\AppData\Local\Temp\Bank_details.exe
"C:\Users\Admin\AppData\Local\Temp\Bank_details.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Adds Run entry to start application
PID:652
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Program Files (x86)\internet explorer\ieinstal.exe"
  2⤵
  PID:4032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4032-0-0x0000000000540000-0x0000000000575000-memory.dmp

Filesize
212KB

Download
memory/4032-2-0x0000000000540000-0x0000000000575000-memory.dmp

Filesize
212KB

Download