netwire | 4eb3eb429cc68448b279c9375ac72e8cefbb0e7765569bf4ba416777cd2a4ead

Analysis

max time kernel
104s
max time network
149s
platform
windows10_x64
resource
win10v20201028
submitted
11/03/2021, 14:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CF10550U5400P000010954.exe
Size 774KB
Sample210311-6jmjvb2kt6
SHA256 4eb3eb429cc68448b279c9375ac72e8cefbb0e7765569bf4ba416777cd2a4ead
MD5 bf29bce9cf1877fe2551c755ced3484e
SHA1 7a6276a3353ba9a5667749e4ff8a8f9dfb73335d
SHA512 6bf1dfc264906ea07378843e60860c0a3523e520add65eb8404240e445bc7b799cf90c17016a6a8e6bc88fb316349b5fcc8c76a1b4a8f281ed2407726142cedd
MD5 SHA1 SHA512

Score

10^/10

netwire botnet persistence stealer

Malware Config

Signatures

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zezfx = "C:\\Users\\Public\\Libraries\\xfzeZ.url"	CF10550U5400P000010954.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1112 set thread context of 3448	1112	CF10550U5400P000010954.exe	79

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 3448	1112	CF10550U5400P000010954.exe	79
PID 1112 wrote to memory of 3448	1112	CF10550U5400P000010954.exe	79
PID 1112 wrote to memory of 3448	1112	CF10550U5400P000010954.exe	79
PID 1112 wrote to memory of 3448	1112	CF10550U5400P000010954.exe	79
PID 1112 wrote to memory of 3448	1112	CF10550U5400P000010954.exe	79

C:\Users\Admin\AppData\Local\Temp\CF10550U5400P000010954.exe
"C:\Users\Admin\AppData\Local\Temp\CF10550U5400P000010954.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Users\Admin\AppData\Local\Temp\CF10550U5400P000010954.exe
  C:\Users\Admin\AppData\Local\Temp\CF10550U5400P000010954.exe
  2⤵
  PID:3448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1112-2-0x00000000004E0000-0x00000000004E1000-memory.dmp

Download

memory/3448-3-0x0000000000540000-0x0000000000576000-memory.dmp

Download

memory/3448-6-0x00000000004D0000-0x0000000000504000-memory.dmp

Download

memory/3448-5-0x0000000000540000-0x0000000000576000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads