netwire | 41dbe67f8521046283d43077e26d6fef8a830e94f6ad1b1765dc5056f8d81846

General

Target

Payment notification.exe
Size

813KB
MD5

fe640ee4067329f2713d5c2ecc63ab9f
SHA1

33f0a12a80b686159822fce665422546a49348b5
SHA256

41dbe67f8521046283d43077e26d6fef8a830e94f6ad1b1765dc5056f8d81846
SHA512

5e16b4f3543f317d1d0b9a3134a2a71849b3b79aa324b2a52bd2ae5a62f3231292a8904dbac9019b6abe4aa03ed5f023896b3458d9d40a2e005861d10ea842a1

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1628-9-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1628-10-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1628-11-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

Payment notification.exe

description pid process target process

PID 1068 set thread context of 1628 1068 Payment notification.exe Payment notification.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

568 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Payment notification.exe

pid process

1068 Payment notification.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Payment notification.exe

description pid process

Token: SeDebugPrivilege 1068 Payment notification.exe

description	pid	process	target process
PID 1068 set thread context of 1628	1068	Payment notification.exe	Payment notification.exe

pid	process
568	schtasks.exe

pid	process
1068	Payment notification.exe

description	pid	process
Token: SeDebugPrivilege	1068	Payment notification.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

Payment notification.exe

description	pid	process	target process
PID 1068 wrote to memory of 568	1068	Payment notification.exe	schtasks.exe
PID 1068 wrote to memory of 568	1068	Payment notification.exe	schtasks.exe
PID 1068 wrote to memory of 568	1068	Payment notification.exe	schtasks.exe
PID 1068 wrote to memory of 568	1068	Payment notification.exe	schtasks.exe
PID 1068 wrote to memory of 1628	1068	Payment notification.exe	Payment notification.exe
PID 1068 wrote to memory of 1628	1068	Payment notification.exe	Payment notification.exe
PID 1068 wrote to memory of 1628	1068	Payment notification.exe	Payment notification.exe
PID 1068 wrote to memory of 1628	1068	Payment notification.exe	Payment notification.exe
PID 1068 wrote to memory of 1628	1068	Payment notification.exe	Payment notification.exe
PID 1068 wrote to memory of 1628	1068	Payment notification.exe	Payment notification.exe
PID 1068 wrote to memory of 1628	1068	Payment notification.exe	Payment notification.exe
PID 1068 wrote to memory of 1628	1068	Payment notification.exe	Payment notification.exe
PID 1068 wrote to memory of 1628	1068	Payment notification.exe	Payment notification.exe
PID 1068 wrote to memory of 1628	1068	Payment notification.exe	Payment notification.exe
PID 1068 wrote to memory of 1628	1068	Payment notification.exe	Payment notification.exe
PID 1068 wrote to memory of 1628	1068	Payment notification.exe	Payment notification.exe

C:\Users\Admin\AppData\Local\Temp\Payment notification.exe
"C:\Users\Admin\AppData\Local\Temp\Payment notification.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mZkwuSmrC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7ED.tmp"
2⤵
- Creates scheduled task(s)
PID:568

C:\Users\Admin\AppData\Local\Temp\Payment notification.exe
"{path}"
2⤵
PID:1628

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7ED.tmp
MD5
4f1612b4bf50ff04ce8365832268915c

SHA1
c23f73ce7cc6c51e6910c00df5d482048326ab8b

SHA256
beb6d553b1df4118b56224bc6fa5d874efe9896d21c81c64c842a531d785b67b

SHA512
91ad78623cee5f474b4db1f1e55e515b1a69254d28285cc3d65486f8b0edde818ef5881c13642cfca3c3b61d673a34e07d0d8a6bb1d71bd297314264393336a4

Download Submit
memory/568-7-0x0000000000000000-mapping.dmp

Download
memory/1068-2-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/1068-3-0x00000000013E0000-0x00000000013E1000-memory.dmp

Filesize
4KB

Download
memory/1068-5-0x0000000000320000-0x000000000032E000-memory.dmp

Filesize
56KB

Download
memory/1068-6-0x0000000005670000-0x00000000056F7000-memory.dmp

Filesize
540KB

Download
memory/1628-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1628-10-0x000000000040242D-mapping.dmp

Download
memory/1628-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads