netwire | hxxp://stellar-airdrop[.]com/download/Begantoda[.]exe

General

Target

http://stellar-airdrop.com/download/Begantoda.exe
Sample

210303-dkh3s21yne

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3176-24-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/3176-25-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/3176-26-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

Begantoda.exe

pid process

3752 Begantoda.exe

pid	process
3752	Begantoda.exe

Drops startup file 2 IoCs

Processes:

pOwERsHeLl.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trevorrendo.exe	pOwERsHeLl.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trevorrendo.exe	pOwERsHeLl.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Begantoda.exe

description pid process target process

PID 3752 set thread context of 3176 3752 Begantoda.exe RegAsm.exe

description	pid	process	target process
PID 3752 set thread context of 3176	3752	Begantoda.exe	RegAsm.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = de4ef1e88fadd601	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30871658"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30871658"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bc41ada2ccc7e240b1b728abc3c9d14500000000020000000000106600000001000020000000c9548ae410b514134df8204d5a2b34bfc91a8b45e129642234789b75f968d66e000000000e80000000020000200000008929f3d8abef51051b2965d7b626939cf407901fd01c75ea6eb4850e261294eb200000007317dc882918f7800c117d4543dd72d6d13c257afcdc4ae28c0da8da4ac8cabd400000006c5355f1c8c0fd6e10fcfb6b04322ad3ceb36340aa3434ca881185c89c8bbb0e55a5a569fb90b0bff8b14e0c3cabd36f124703f517183dc9274d9432fbfa3cc3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30871658"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15362CAE-7C5E-11EB-BEBD-6E25161A58E2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\RepId\PublicId = "{5C70670C-CE83-4951-AB17-7E6C9D5DE93C}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3924433249"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bc41ada2ccc7e240b1b728abc3c9d1450000000002000000000010660000000100002000000001916291d802da9ef1cd33f27a64faf51ce2bb244d5342dda853dcc62cd09244000000000e8000000002000020000000874338ee594a559bcd7f1941fec8ede0ad6b875e3dda6ed5e40a9dd36c93d8f220000000d5e5b2c659e59166b0c5f945ef2ba7e9ba6e11ce960f12fe9bffc574220deea6400000006f5cd751e2ec0e39e45bf3a031f338b54fafa6daa181422091049951a66a02a79d9234a05383f0325abea054c3dd64833f073070721cb2980301f88a4de38a72	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b027dfea6a10d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003c000000900300001c020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3936123514"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0cfd0ea6a10d701	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3924433249"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Begantoda.exepOwERsHeLl.exe

pid process

3752 Begantoda.exe
3752 Begantoda.exe
1460 pOwERsHeLl.exe
1460 pOwERsHeLl.exe
1460 pOwERsHeLl.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Begantoda.exepOwERsHeLl.exe

description pid process

Token: SeDebugPrivilege 3752 Begantoda.exe
Token: SeDebugPrivilege 1460 pOwERsHeLl.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exe

pid process

1232 iexplore.exe
1232 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1232 iexplore.exe
1232 iexplore.exe
3976 IEXPLORE.EXE
3976 IEXPLORE.EXE

pid	process
3752	Begantoda.exe
3752	Begantoda.exe
1460	pOwERsHeLl.exe
1460	pOwERsHeLl.exe
1460	pOwERsHeLl.exe

description	pid	process
Token: SeDebugPrivilege	3752	Begantoda.exe
Token: SeDebugPrivilege	1460	pOwERsHeLl.exe

pid	process
1232	iexplore.exe
1232	iexplore.exe

pid	process
1232	iexplore.exe
1232	iexplore.exe
3976	IEXPLORE.EXE
3976	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

iexplore.exeBegantoda.exe

description	pid	process	target process
PID 1232 wrote to memory of 3976	1232	iexplore.exe	IEXPLORE.EXE
PID 1232 wrote to memory of 3976	1232	iexplore.exe	IEXPLORE.EXE
PID 1232 wrote to memory of 3976	1232	iexplore.exe	IEXPLORE.EXE
PID 1232 wrote to memory of 3752	1232	iexplore.exe	Begantoda.exe
PID 1232 wrote to memory of 3752	1232	iexplore.exe	Begantoda.exe
PID 1232 wrote to memory of 3752	1232	iexplore.exe	Begantoda.exe
PID 3752 wrote to memory of 2084	3752	Begantoda.exe	RegAsm.exe
PID 3752 wrote to memory of 2084	3752	Begantoda.exe	RegAsm.exe
PID 3752 wrote to memory of 2084	3752	Begantoda.exe	RegAsm.exe
PID 3752 wrote to memory of 3176	3752	Begantoda.exe	RegAsm.exe
PID 3752 wrote to memory of 3176	3752	Begantoda.exe	RegAsm.exe
PID 3752 wrote to memory of 3176	3752	Begantoda.exe	RegAsm.exe
PID 3752 wrote to memory of 3176	3752	Begantoda.exe	RegAsm.exe
PID 3752 wrote to memory of 3176	3752	Begantoda.exe	RegAsm.exe
PID 3752 wrote to memory of 3176	3752	Begantoda.exe	RegAsm.exe
PID 3752 wrote to memory of 3176	3752	Begantoda.exe	RegAsm.exe
PID 3752 wrote to memory of 3176	3752	Begantoda.exe	RegAsm.exe
PID 3752 wrote to memory of 3176	3752	Begantoda.exe	RegAsm.exe
PID 3752 wrote to memory of 3176	3752	Begantoda.exe	RegAsm.exe
PID 3752 wrote to memory of 3176	3752	Begantoda.exe	RegAsm.exe
PID 3752 wrote to memory of 1460	3752	Begantoda.exe	pOwERsHeLl.exe
PID 3752 wrote to memory of 1460	3752	Begantoda.exe	pOwERsHeLl.exe
PID 3752 wrote to memory of 1460	3752	Begantoda.exe	pOwERsHeLl.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://stellar-airdrop.com/download/Begantoda.exe
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1232 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3976

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0PZ2C2W1\Begantoda.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0PZ2C2W1\Begantoda.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3752

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:2084

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:3176

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pOwERsHeLl.exe
"pOwERsHeLl.exe" Copy-Item 'C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0PZ2C2W1\Begantoda.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trevorrendo.exe'
3⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1460

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
8f926706e689fe76043072abc7e883ec

SHA1
cbe1a4242672c1ac372045c9e815effebdfc6ae8

SHA256
de78007e2b2a44a4a2fb2c6202c11ac4aec7ac67b0afe7b809ea8b85c4dcfbc9

SHA512
486310b2109876bb2f08a2020b83f5ddeb2e7dcb1425628d305f2a000e3117083c1b962ce010132c98311b02679fe26e8ac218a41103a9499a6cd99529d62232

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
6d870c5972106083df624ed19a9c2b06

SHA1
e6946c1cdd728466d5cdc780ae5f6a78aefd2e18

SHA256
96d1fe2355cab3546eae8c4c05cbcbf42df56f373ecbcfa2b42fa35539366c03

SHA512
1b06cbf163c1908b8a3313c41ab8725b48d8c1c6e049161e98f917d4507d37532b7c01791abf530785b66e46965a3d40d3eb43a88cb1d5ae68f41ac79416c0b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0PZ2C2W1\Begantoda.exe
MD5
b4ff2825679835badd44aaa15256638c

SHA1
f67f7fac7368250b8df4d0a9b05408f775fe5f9c

SHA256
691f3e4b532cb3802630762dadc0eb5f894a6b5463ab5723ef67379ef3f9d31f

SHA512
33339d4ca2687a802ae61679bba672f926020fb319794e84bbdc84c3e68c744b8e241784f2ae5daa08ac78f58ca570539cd1ba446ec3ee4315c032937369db5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0PZ2C2W1\Begantoda.exe.lw2cd78.partial
MD5
b4ff2825679835badd44aaa15256638c

SHA1
f67f7fac7368250b8df4d0a9b05408f775fe5f9c

SHA256
691f3e4b532cb3802630762dadc0eb5f894a6b5463ab5723ef67379ef3f9d31f

SHA512
33339d4ca2687a802ae61679bba672f926020fb319794e84bbdc84c3e68c744b8e241784f2ae5daa08ac78f58ca570539cd1ba446ec3ee4315c032937369db5a

Download Submit
memory/1460-40-0x0000000009A60000-0x0000000009A61000-memory.dmp

Filesize
4KB

Download
memory/1460-33-0x00000000082E0000-0x00000000082E1000-memory.dmp

Filesize
4KB

Download
memory/1460-27-0x0000000000000000-mapping.dmp

Download
memory/1460-39-0x0000000008AA0000-0x0000000008AA1000-memory.dmp

Filesize
4KB

Download
memory/1460-38-0x0000000008BC0000-0x0000000008BC1000-memory.dmp

Filesize
4KB

Download
memory/1460-37-0x0000000008150000-0x0000000008151000-memory.dmp

Filesize
4KB

Download
memory/1460-36-0x0000000007352000-0x0000000007353000-memory.dmp

Filesize
4KB

Download
memory/1460-35-0x0000000007350000-0x0000000007351000-memory.dmp

Filesize
4KB

Download
memory/1460-34-0x0000000008380000-0x0000000008381000-memory.dmp

Filesize
4KB

Download
memory/1460-41-0x0000000009750000-0x0000000009751000-memory.dmp

Filesize
4KB

Download
memory/1460-32-0x0000000008170000-0x0000000008171000-memory.dmp

Filesize
4KB

Download
memory/1460-31-0x0000000007FF0000-0x0000000007FF1000-memory.dmp

Filesize
4KB

Download
memory/1460-30-0x0000000007990000-0x0000000007991000-memory.dmp

Filesize
4KB

Download
memory/1460-29-0x00000000072A0000-0x00000000072A1000-memory.dmp

Filesize
4KB

Download
memory/1460-42-0x00000000097A0000-0x00000000097A1000-memory.dmp

Filesize
4KB

Download
memory/1460-44-0x0000000007353000-0x0000000007354000-memory.dmp

Filesize
4KB

Download
memory/1460-28-0x000000006F650000-0x000000006FD3E000-memory.dmp

Filesize
6.9MB

Download
memory/3176-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3176-25-0x000000000040242D-mapping.dmp

Download
memory/3176-26-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3752-13-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/3752-9-0x0000000004C40000-0x0000000004C41000-memory.dmp

Filesize
4KB

Download
memory/3752-20-0x0000000004EC9000-0x0000000004ECF000-memory.dmp

Filesize
24KB

Download
memory/3752-19-0x0000000004EC8000-0x0000000004EC9000-memory.dmp

Filesize
4KB

Download
memory/3752-18-0x0000000004EC7000-0x0000000004EC8000-memory.dmp

Filesize
4KB

Download
memory/3752-17-0x0000000004EC6000-0x0000000004EC7000-memory.dmp

Filesize
4KB

Download
memory/3752-16-0x0000000004EC5000-0x0000000004EC6000-memory.dmp

Filesize
4KB

Download
memory/3752-15-0x0000000004EC3000-0x0000000004EC5000-memory.dmp

Filesize
8KB

Download
memory/3752-14-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download
memory/3752-4-0x0000000000000000-mapping.dmp

Download
memory/3752-12-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Filesize
4KB

Download
memory/3752-11-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Filesize
4KB

Download
memory/3752-10-0x00000000051E0000-0x00000000051E1000-memory.dmp

Filesize
4KB

Download
memory/3752-23-0x0000000005980000-0x000000000598C000-memory.dmp

Filesize
48KB

Download
memory/3752-7-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/3752-6-0x000000006F650000-0x000000006FD3E000-memory.dmp

Filesize
6.9MB

Download
memory/3976-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads