netwire | f0d83e1cb17751183ffa5fd073d26287a8b6e003aeaccf75523824acc117beab

General

Target

SIM Swap Partner's Staff.docx.exe
Size

649KB
MD5

421fea142d75f349e7ab849bcbb7eb51
SHA1

ffca7676c442ad30521abacae9f177b924e533d9
SHA256

f0d83e1cb17751183ffa5fd073d26287a8b6e003aeaccf75523824acc117beab
SHA512

199b9165f36748bdc2ef188384dfa696c20f50f89266186361419049652a518d7d29ab49763e98a0bbd76ad0ffafd93da4d2eda2a573cb1f958c3f71420a5799

Score

10^/10

rat persistence botnet stealer netwire

Malware Config

Signatures

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

SIM Swap Partner's Staff.docx.exe

description	pid	process	target process
PID 1100 wrote to memory of 1048	1100	SIM Swap Partner's Staff.docx.exe	ieinstal.exe
PID 1100 wrote to memory of 1048	1100	SIM Swap Partner's Staff.docx.exe	ieinstal.exe
PID 1100 wrote to memory of 1048	1100	SIM Swap Partner's Staff.docx.exe	ieinstal.exe
PID 1100 wrote to memory of 1048	1100	SIM Swap Partner's Staff.docx.exe	ieinstal.exe
PID 1100 wrote to memory of 1048	1100	SIM Swap Partner's Staff.docx.exe	ieinstal.exe
PID 1100 wrote to memory of 1048	1100	SIM Swap Partner's Staff.docx.exe	ieinstal.exe
PID 1100 wrote to memory of 1048	1100	SIM Swap Partner's Staff.docx.exe	ieinstal.exe
PID 1100 wrote to memory of 1048	1100	SIM Swap Partner's Staff.docx.exe	ieinstal.exe
PID 1100 wrote to memory of 1048	1100	SIM Swap Partner's Staff.docx.exe	ieinstal.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SIM Swap Partner's Staff.docx.exe

description pid process target process

PID 1100 set thread context of 1048 1100 SIM Swap Partner's Staff.docx.exe ieinstal.exe

description	pid	process	target process
PID 1100 set thread context of 1048	1100	SIM Swap Partner's Staff.docx.exe	ieinstal.exe

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1048-0-0x0000000000400000-0x000000000042B000-memory.dmp	netwire
behavioral1/memory/1048-2-0x0000000000400000-0x000000000042B000-memory.dmp	netwire

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SIM Swap Partner's Staff.docx.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Hlto = "C:\\Users\\Admin\\AppData\\Local\\Hlto\\Hlto.hta"	SIM Swap Partner's Staff.docx.exe

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

C:\Users\Admin\AppData\Local\Temp\SIM Swap Partner's Staff.docx.exe
"C:\Users\Admin\AppData\Local\Temp\SIM Swap Partner's Staff.docx.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Adds Run entry to start application
PID:1100

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
2⤵
PID:1048

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1048-1-0x00000000004026D0-mapping.dmp

Download
memory/1048-2-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads