netwire | 21b720127c08d4ba7b5fe44f6c1f555db9b2b98a3adc53b9f63a2fe63e6e5ead

General

Target

NEW ORDERS.exe
Size

587KB
MD5

25db6bf1906d3f8e82f2e0be5c84cce5
SHA1

b25465a07d80934f44c4f94c87848c19aeaa4dec
SHA256

21b720127c08d4ba7b5fe44f6c1f555db9b2b98a3adc53b9f63a2fe63e6e5ead
SHA512

6edb791a243b845d6dcd6226207a6a5196e01a9cd21c6d3bd6c6c03ba263ae077a18c62d7935a01ac764621fa107a9c5aefb376f2f35c05d86134b5dab0c62ad

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1008-13-0x0000000000400000-0x000000000042B000-memory.dmp	netwire
behavioral2/memory/1008-14-0x00000000004026D0-mapping.dmp	netwire
behavioral2/memory/1008-15-0x0000000000400000-0x000000000042B000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

NEW ORDERS.exe

description pid process target process

PID 4804 set thread context of 1008 4804 NEW ORDERS.exe NEW ORDERS.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

596 schtasks.exe

description	pid	process	target process
PID 4804 set thread context of 1008	4804	NEW ORDERS.exe	NEW ORDERS.exe

pid	process
596	schtasks.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

NEW ORDERS.exe

description	pid	process	target process
PID 4804 wrote to memory of 596	4804	NEW ORDERS.exe	schtasks.exe
PID 4804 wrote to memory of 596	4804	NEW ORDERS.exe	schtasks.exe
PID 4804 wrote to memory of 596	4804	NEW ORDERS.exe	schtasks.exe
PID 4804 wrote to memory of 1008	4804	NEW ORDERS.exe	NEW ORDERS.exe
PID 4804 wrote to memory of 1008	4804	NEW ORDERS.exe	NEW ORDERS.exe
PID 4804 wrote to memory of 1008	4804	NEW ORDERS.exe	NEW ORDERS.exe
PID 4804 wrote to memory of 1008	4804	NEW ORDERS.exe	NEW ORDERS.exe
PID 4804 wrote to memory of 1008	4804	NEW ORDERS.exe	NEW ORDERS.exe
PID 4804 wrote to memory of 1008	4804	NEW ORDERS.exe	NEW ORDERS.exe
PID 4804 wrote to memory of 1008	4804	NEW ORDERS.exe	NEW ORDERS.exe
PID 4804 wrote to memory of 1008	4804	NEW ORDERS.exe	NEW ORDERS.exe
PID 4804 wrote to memory of 1008	4804	NEW ORDERS.exe	NEW ORDERS.exe
PID 4804 wrote to memory of 1008	4804	NEW ORDERS.exe	NEW ORDERS.exe

C:\Users\Admin\AppData\Local\Temp\NEW ORDERS.exe
"C:\Users\Admin\AppData\Local\Temp\NEW ORDERS.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4804

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HPeNXWq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp180D.tmp"
2⤵
- Creates scheduled task(s)
PID:596

C:\Users\Admin\AppData\Local\Temp\NEW ORDERS.exe
"{path}"
2⤵
PID:1008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp180D.tmp
MD5
d9c35973da1b9dbbb46eff522e492380

SHA1
b58682bb388275438b11dee6a3345f1d200cd24d

SHA256
5925a4e6d139d2ef756f759af80ec5901ada8d8a64f97a7d20171ab184be6289

SHA512
73326e423231c00a8f74cb1de0b2b2af66b2f073d9d2f5b2a36b9d936b3ff22ddb82eb4fc9563b01cdb7665d347fda866bfffb7914fb4528757e5f6d534c10af

Download Submit
memory/596-11-0x0000000000000000-mapping.dmp

Download
memory/1008-15-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1008-14-0x00000000004026D0-mapping.dmp

Download
memory/1008-13-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4804-6-0x0000000005230000-0x0000000005231000-memory.dmp

Filesize
4KB

Download
memory/4804-9-0x00000000088F0000-0x000000000897D000-memory.dmp

Filesize
564KB

Download
memory/4804-10-0x0000000008A20000-0x0000000008A21000-memory.dmp

Filesize
4KB

Download
memory/4804-8-0x0000000005440000-0x0000000005444000-memory.dmp

Filesize
16KB

Download
memory/4804-7-0x00000000051A0000-0x00000000051A1000-memory.dmp

Filesize
4KB

Download
memory/4804-2-0x00000000739D0000-0x00000000740BE000-memory.dmp

Filesize
6.9MB

Download
memory/4804-5-0x0000000005690000-0x0000000005691000-memory.dmp

Filesize
4KB

Download
memory/4804-3-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads