netwire | f3ad47ca842225f405e277f5f2b0521266fe65a90bf746ac39a67990835ddf14

Analysis

max time kernel
91s
max time network
131s
platform
windows10_x64
resource
win10v20210408
submitted
03-05-2021 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Document.exe
Size

753KB
MD5

abb973cc735baa96deac84f5653fd89a
SHA1

59c52bab6062e461866be8b918a376e4362571e1
SHA256

f3ad47ca842225f405e277f5f2b0521266fe65a90bf746ac39a67990835ddf14
SHA512

b44074cc3a0b114e3580c2222c29782d42c814ab365731a97c3f76bbc62206a6cd59a12f86d16aeeb8004c84d5ad871bf2b058d291dfb66cf2fd138e0159b59b

Score

10^/10

netwire botnet persistence stealer

Malware Config

Signatures

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

27 2776 mshta.exe

flow	pid	process
27	2776	mshta.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Document.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Clnzfd = "C:\\Users\\Public\\Libraries\\dfznlC.url"	Document.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Document.exe

description	pid	process	target process
PID 908 wrote to memory of 2776	908	Document.exe	mshta.exe
PID 908 wrote to memory of 2776	908	Document.exe	mshta.exe
PID 908 wrote to memory of 2776	908	Document.exe	mshta.exe
PID 908 wrote to memory of 2776	908	Document.exe	mshta.exe
PID 908 wrote to memory of 2776	908	Document.exe	mshta.exe
PID 908 wrote to memory of 2776	908	Document.exe	mshta.exe
PID 908 wrote to memory of 2776	908	Document.exe	mshta.exe
PID 908 wrote to memory of 2776	908	Document.exe	mshta.exe
PID 908 wrote to memory of 2776	908	Document.exe	mshta.exe
PID 908 wrote to memory of 2776	908	Document.exe	mshta.exe
PID 908 wrote to memory of 2776	908	Document.exe	mshta.exe
PID 908 wrote to memory of 2776	908	Document.exe	mshta.exe
PID 908 wrote to memory of 2776	908	Document.exe	mshta.exe
PID 908 wrote to memory of 2776	908	Document.exe	mshta.exe
PID 908 wrote to memory of 2776	908	Document.exe	mshta.exe

C:\Users\Admin\AppData\Local\Temp\Document.exe
"C:\Users\Admin\AppData\Local\Temp\Document.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\SysWOW64\mshta.exe
C:\Windows\System32\mshta.exe
2⤵
- Blocklisted process makes network request
PID:2776

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/908-114-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2776-115-0x0000000000000000-mapping.dmp

Download
memory/2776-117-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/2776-116-0x00000000029E0000-0x00000000029E1000-memory.dmp

Filesize
4KB

Download
memory/2776-120-0x0000000010550000-0x0000000010586000-memory.dmp

Filesize
216KB

Download
memory/2776-121-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2776-119-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download