netwire | 7915d92e56a86feb90323274532ccfefef357210f840b5dac3999399e7255193

General

Target

SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe
Size

731KB
MD5

6b33065b314dbb152d798237de373550
SHA1

4c654b9f7b2298d213048f6523f7dbd21c1cc64b
SHA256

7915d92e56a86feb90323274532ccfefef357210f840b5dac3999399e7255193
SHA512

b51d5e2644dc7a0cb0cfdf0fb2a98c5ad5c604366d584ded312f9d2cad18465d9d77ed4f8df8444ccdc79a6bce84a6b89de48531a1b9de15a46c71ee712ba457

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1324-13-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1324-14-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1324-21-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Drops startup file 2 IoCs

Processes:

pOwERsHeLl.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Bastardok.exe	pOwERsHeLl.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Bastardok.exe	pOwERsHeLl.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe

description pid process target process

PID 1852 set thread context of 1324 1852 SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe RegAsm.exe

description	pid	process	target process
PID 1852 set thread context of 1324	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exepOwERsHeLl.exe

pid	process
1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe
1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe
604	pOwERsHeLl.exe
604	pOwERsHeLl.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exepOwERsHeLl.exe

description pid process

Token: SeDebugPrivilege 1852 SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe
Token: SeDebugPrivilege 604 pOwERsHeLl.exe

description	pid	process
Token: SeDebugPrivilege	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe
Token: SeDebugPrivilege	604	pOwERsHeLl.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe

description	pid	process	target process
PID 1852 wrote to memory of 1316	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 1316	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 1316	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 1316	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 1316	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 1316	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 1316	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 1324	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 1324	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 1324	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 1324	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 1324	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 1324	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 1324	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 1324	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 1324	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 1324	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 1324	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 1324	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 1324	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 1324	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 1324	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	RegAsm.exe
PID 1852 wrote to memory of 604	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	pOwERsHeLl.exe
PID 1852 wrote to memory of 604	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	pOwERsHeLl.exe
PID 1852 wrote to memory of 604	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	pOwERsHeLl.exe
PID 1852 wrote to memory of 604	1852	SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe	pOwERsHeLl.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1316

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1324

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pOwERsHeLl.exe
"pOwERsHeLl.exe" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.30596.12305.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Bastardok.exe'
2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/604-16-0x0000000000000000-mapping.dmp

Download
memory/604-42-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download
memory/604-35-0x000000007EF30000-0x000000007EF31000-memory.dmp

Filesize
4KB

Download
memory/604-34-0x00000000060F0000-0x00000000060F1000-memory.dmp

Filesize
4KB

Download
memory/604-33-0x00000000056B0000-0x00000000056B1000-memory.dmp

Filesize
4KB

Download
memory/604-28-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download
memory/604-25-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/604-24-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/604-22-0x0000000004920000-0x0000000004921000-memory.dmp

Filesize
4KB

Download
memory/604-23-0x0000000004922000-0x0000000004923000-memory.dmp

Filesize
4KB

Download
memory/604-20-0x0000000004960000-0x0000000004961000-memory.dmp

Filesize
4KB

Download
memory/604-19-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/604-18-0x0000000073860000-0x0000000073F4E000-memory.dmp

Filesize
6.9MB

Download
memory/1324-15-0x00000000760F1000-0x00000000760F3000-memory.dmp

Filesize
8KB

Download
memory/1324-21-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1324-14-0x000000000040242D-mapping.dmp

Download
memory/1324-13-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1852-6-0x0000000004E95000-0x0000000004EA6000-memory.dmp

Filesize
68KB

Download
memory/1852-11-0x0000000004EAA000-0x0000000004EAB000-memory.dmp

Filesize
4KB

Download
memory/1852-12-0x0000000000A20000-0x0000000000A2C000-memory.dmp

Filesize
48KB

Download
memory/1852-2-0x0000000074570000-0x0000000074C5E000-memory.dmp

Filesize
6.9MB

Download
memory/1852-7-0x0000000004EA6000-0x0000000004EA7000-memory.dmp

Filesize
4KB

Download
memory/1852-8-0x0000000004EA7000-0x0000000004EA8000-memory.dmp

Filesize
4KB

Download
memory/1852-10-0x0000000004EA9000-0x0000000004EAA000-memory.dmp

Filesize
4KB

Download
memory/1852-9-0x0000000004EA8000-0x0000000004EA9000-memory.dmp

Filesize
4KB

Download
memory/1852-5-0x0000000004E90000-0x0000000004E91000-memory.dmp

Filesize
4KB

Download
memory/1852-3-0x0000000000E20000-0x0000000000E21000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads