netwire | 21b720127c08d4ba7b5fe44f6c1f555db9b2b98a3adc53b9f63a2fe63e6e5ead

Analysis

max time kernel
122s
max time network
126s
platform
windows10_x64
resource
win10v20201028
submitted
17/12/2020, 08:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEW ORDERS.exe
Size 587KB
Sample201217-83xa51lbj2
SHA256 21b720127c08d4ba7b5fe44f6c1f555db9b2b98a3adc53b9f63a2fe63e6e5ead
MD5 25db6bf1906d3f8e82f2e0be5c84cce5
SHA1 b25465a07d80934f44c4f94c87848c19aeaa4dec
SHA512 6edb791a243b845d6dcd6226207a6a5196e01a9cd21c6d3bd6c6c03ba263ae077a18c62d7935a01ac764621fa107a9c5aefb376f2f35c05d86134b5dab0c62ad
MD5 SHA1 SHA512

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/1008-13-0x0000000000400000-0x000000000042B000-memory.dmp	netwire
behavioral2/memory/1008-14-0x00000000004026D0-mapping.dmp	netwire
behavioral2/memory/1008-15-0x0000000000400000-0x000000000042B000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4804 set thread context of 1008	4804	NEW ORDERS.exe	80

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
596	schtasks.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 596	4804	NEW ORDERS.exe	78
PID 4804 wrote to memory of 596	4804	NEW ORDERS.exe	78
PID 4804 wrote to memory of 596	4804	NEW ORDERS.exe	78
PID 4804 wrote to memory of 1008	4804	NEW ORDERS.exe	80
PID 4804 wrote to memory of 1008	4804	NEW ORDERS.exe	80
PID 4804 wrote to memory of 1008	4804	NEW ORDERS.exe	80
PID 4804 wrote to memory of 1008	4804	NEW ORDERS.exe	80
PID 4804 wrote to memory of 1008	4804	NEW ORDERS.exe	80
PID 4804 wrote to memory of 1008	4804	NEW ORDERS.exe	80
PID 4804 wrote to memory of 1008	4804	NEW ORDERS.exe	80
PID 4804 wrote to memory of 1008	4804	NEW ORDERS.exe	80
PID 4804 wrote to memory of 1008	4804	NEW ORDERS.exe	80
PID 4804 wrote to memory of 1008	4804	NEW ORDERS.exe	80

C:\Users\Admin\AppData\Local\Temp\NEW ORDERS.exe
"C:\Users\Admin\AppData\Local\Temp\NEW ORDERS.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HPeNXWq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp180D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:596
- C:\Users\Admin\AppData\Local\Temp\NEW ORDERS.exe
  "{path}"
  2⤵
  PID:1008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1008-15-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1008-13-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4804-6-0x0000000005230000-0x0000000005231000-memory.dmp

Download

memory/4804-9-0x00000000088F0000-0x000000000897D000-memory.dmp

Download

memory/4804-10-0x0000000008A20000-0x0000000008A21000-memory.dmp

Download

memory/4804-8-0x0000000005440000-0x0000000005444000-memory.dmp

Download

memory/4804-7-0x00000000051A0000-0x00000000051A1000-memory.dmp

Download

memory/4804-2-0x00000000739D0000-0x00000000740BE000-memory.dmp

Download

memory/4804-5-0x0000000005690000-0x0000000005691000-memory.dmp

Download

memory/4804-3-0x00000000008D0000-0x00000000008D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads