netwire | 98a046d5edb9540592c6b45a2efa070864637109894d8d831e804ba09bbbcbb4

Analysis

max time kernel
3s
max time network
113s
platform
windows7_x64
resource
win7v20201028
submitted
03/03/2021, 18:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Pago Mar 2021 at 1.15_PP3343_PDF.exe
Size 235KB
Sample210303-py98zbcfas
SHA256 98a046d5edb9540592c6b45a2efa070864637109894d8d831e804ba09bbbcbb4
MD5 754fd049502c2333dc04447b86a4f4b7
SHA1 357ca18d11d7d61b3826e47d8f69579d8909508a
SHA512 cf8e5f13da216772295ee8e5c06fc46641c469dfbb04d347f535e0c3abcd5a0508752090295b350777695d49722ac35d65d1bc561ef679e48d3a16847117e785
MD5 SHA1 SHA512

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1528-6-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Loads dropped DLL 1 IoCs

pid	Process
1888	Pago Mar 2021 at 1.15_PP3343_PDF.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1888 set thread context of 1528	1888	Pago Mar 2021 at 1.15_PP3343_PDF.exe	26

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1888	Pago Mar 2021 at 1.15_PP3343_PDF.exe
1888	Pago Mar 2021 at 1.15_PP3343_PDF.exe
1888	Pago Mar 2021 at 1.15_PP3343_PDF.exe
1888	Pago Mar 2021 at 1.15_PP3343_PDF.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1888	Pago Mar 2021 at 1.15_PP3343_PDF.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1528	1888	Pago Mar 2021 at 1.15_PP3343_PDF.exe	26
PID 1888 wrote to memory of 1528	1888	Pago Mar 2021 at 1.15_PP3343_PDF.exe	26
PID 1888 wrote to memory of 1528	1888	Pago Mar 2021 at 1.15_PP3343_PDF.exe	26
PID 1888 wrote to memory of 1528	1888	Pago Mar 2021 at 1.15_PP3343_PDF.exe	26
PID 1888 wrote to memory of 1528	1888	Pago Mar 2021 at 1.15_PP3343_PDF.exe	26

C:\Users\Admin\AppData\Local\Temp\Pago Mar 2021 at 1.15_PP3343_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Pago Mar 2021 at 1.15_PP3343_PDF.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Local\Temp\Pago Mar 2021 at 1.15_PP3343_PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\Pago Mar 2021 at 1.15_PP3343_PDF.exe"
  2⤵
  PID:1528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1528-6-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1888-2-0x0000000075781000-0x0000000075783000-memory.dmp

Download