netwire | 0b06f4036cfeb9bebf96463b887c650c40dbde0128800dc8872318b4b13f48f5

General

Target

ORDER INQUIRY.doc
Size

1.5MB
MD5

76d29c28ca7c670367293ca72b21c35a
SHA1

4572896caccc56875f0223c84348531daa61d827
SHA256

0b06f4036cfeb9bebf96463b887c650c40dbde0128800dc8872318b4b13f48f5
SHA512

58a6f8a0bd66354588e65a77d554695fab02f83acedc8eef9f1483b6cc0282d8f10ebb6fe2f11dfe27d5428e5453f7aec9364b8fcc38eb912f5819ea71e598eb

Score

10^/10

netwire agilenet botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

79.134.225.52:31360

Attributes

activex_autorun
false
activex_key
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
install_path
keylogger_dir
lock_executable
false
mutex
offline_keylogger
false
password
Favor1000$
registry_autorun
false
startup_name
use_mutex
false

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/924-80-0x0000000000400000-0x0000000000436000-memory.dmp	netwire
behavioral1/memory/924-81-0x0000000000402453-mapping.dmp	netwire
behavioral1/memory/924-84-0x0000000000400000-0x0000000000436000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Blocklisted process makes network request 4 IoCs

Processes:

EQNEDT32.EXE

flow pid process

6 1960 EQNEDT32.EXE
8 1960 EQNEDT32.EXE
10 1960 EQNEDT32.EXE
12 1960 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

098765.exeAddInProcess32.exe

pid process

548 098765.exe
924 AddInProcess32.exe
Loads dropped DLL 3 IoCs

Processes:

EQNEDT32.EXE098765.exe

pid process

1960 EQNEDT32.EXE
1960 EQNEDT32.EXE
548 098765.exe

flow	pid	process
6	1960	EQNEDT32.EXE
8	1960	EQNEDT32.EXE
10	1960	EQNEDT32.EXE
12	1960	EQNEDT32.EXE

pid	process
548	098765.exe
924	AddInProcess32.exe

pid	process
1960	EQNEDT32.EXE
1960	EQNEDT32.EXE
548	098765.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/548-73-0x00000000004C0000-0x00000000004E1000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

Processes:

098765.exe

description pid process target process

PID 548 set thread context of 924 548 098765.exe AddInProcess32.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1960 EQNEDT32.EXE

description	pid	process	target process
PID 548 set thread context of 924	548	098765.exe	AddInProcess32.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
1960	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1684 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

098765.exe

pid process

548 098765.exe
548 098765.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

098765.exe

description pid process

Token: SeDebugPrivilege 548 098765.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1684 WINWORD.EXE
1684 WINWORD.EXE

pid	process
1684	WINWORD.EXE

pid	process
548	098765.exe
548	098765.exe

description	pid	process
Token: SeDebugPrivilege	548	098765.exe

pid	process
1684	WINWORD.EXE
1684	WINWORD.EXE

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

EQNEDT32.EXEWINWORD.EXE098765.exe

description	pid	process	target process
PID 1960 wrote to memory of 548	1960	EQNEDT32.EXE	098765.exe
PID 1960 wrote to memory of 548	1960	EQNEDT32.EXE	098765.exe
PID 1960 wrote to memory of 548	1960	EQNEDT32.EXE	098765.exe
PID 1960 wrote to memory of 548	1960	EQNEDT32.EXE	098765.exe
PID 1684 wrote to memory of 1220	1684	WINWORD.EXE	splwow64.exe
PID 1684 wrote to memory of 1220	1684	WINWORD.EXE	splwow64.exe
PID 1684 wrote to memory of 1220	1684	WINWORD.EXE	splwow64.exe
PID 1684 wrote to memory of 1220	1684	WINWORD.EXE	splwow64.exe
PID 548 wrote to memory of 924	548	098765.exe	AddInProcess32.exe
PID 548 wrote to memory of 924	548	098765.exe	AddInProcess32.exe
PID 548 wrote to memory of 924	548	098765.exe	AddInProcess32.exe
PID 548 wrote to memory of 924	548	098765.exe	AddInProcess32.exe
PID 548 wrote to memory of 924	548	098765.exe	AddInProcess32.exe
PID 548 wrote to memory of 924	548	098765.exe	AddInProcess32.exe
PID 548 wrote to memory of 924	548	098765.exe	AddInProcess32.exe
PID 548 wrote to memory of 924	548	098765.exe	AddInProcess32.exe
PID 548 wrote to memory of 924	548	098765.exe	AddInProcess32.exe
PID 548 wrote to memory of 924	548	098765.exe	AddInProcess32.exe
PID 548 wrote to memory of 924	548	098765.exe	AddInProcess32.exe
PID 548 wrote to memory of 924	548	098765.exe	AddInProcess32.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1220

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1960

C:\Users\Public\098765.exe
C:\Users\Public\098765.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:548

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
3⤵
- Executes dropped EXE
PID:924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1

T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
C:\Users\Public\098765.exe
MD5
59e1199f32a8f13b0efbdd092b02b165

SHA1
aed745bc896ea20b20859f55a3a18ca10e1463e3

SHA256
9133c16f469cf207152a1a8b2d8f0c59533d2f632b17828973c6a6a37b31fa97

SHA512
b6607e0246b398db47de1b852e0b94ab311c5d0d423ce735a6e537b13563f381112afb9311fd6a80a580075dfccfd0f29d4ac8cf224cbd9eee7dbdda75899f8d

Download Submit
C:\Users\Public\098765.exe
MD5
59e1199f32a8f13b0efbdd092b02b165

SHA1
aed745bc896ea20b20859f55a3a18ca10e1463e3

SHA256
9133c16f469cf207152a1a8b2d8f0c59533d2f632b17828973c6a6a37b31fa97

SHA512
b6607e0246b398db47de1b852e0b94ab311c5d0d423ce735a6e537b13563f381112afb9311fd6a80a580075dfccfd0f29d4ac8cf224cbd9eee7dbdda75899f8d

Download Submit
\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
\Users\Public\098765.exe
MD5
59e1199f32a8f13b0efbdd092b02b165

SHA1
aed745bc896ea20b20859f55a3a18ca10e1463e3

SHA256
9133c16f469cf207152a1a8b2d8f0c59533d2f632b17828973c6a6a37b31fa97

SHA512
b6607e0246b398db47de1b852e0b94ab311c5d0d423ce735a6e537b13563f381112afb9311fd6a80a580075dfccfd0f29d4ac8cf224cbd9eee7dbdda75899f8d

Download Submit
\Users\Public\098765.exe
MD5
59e1199f32a8f13b0efbdd092b02b165

SHA1
aed745bc896ea20b20859f55a3a18ca10e1463e3

SHA256
9133c16f469cf207152a1a8b2d8f0c59533d2f632b17828973c6a6a37b31fa97

SHA512
b6607e0246b398db47de1b852e0b94ab311c5d0d423ce735a6e537b13563f381112afb9311fd6a80a580075dfccfd0f29d4ac8cf224cbd9eee7dbdda75899f8d

Download Submit
memory/548-71-0x00000000048A0000-0x00000000048A1000-memory.dmp

Filesize
4KB

Download
memory/548-77-0x0000000000650000-0x000000000065B000-memory.dmp

Filesize
44KB

Download
memory/548-78-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/548-69-0x0000000001390000-0x0000000001391000-memory.dmp

Filesize
4KB

Download
memory/548-66-0x0000000000000000-mapping.dmp

Download
memory/548-73-0x00000000004C0000-0x00000000004E1000-memory.dmp

Filesize
132KB

Download
memory/548-74-0x00000000048A1000-0x00000000048A2000-memory.dmp

Filesize
4KB

Download
memory/924-80-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/924-81-0x0000000000402453-mapping.dmp

Download
memory/924-84-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1220-75-0x0000000000000000-mapping.dmp

Download
memory/1220-76-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmp

Filesize
8KB

Download
memory/1684-60-0x0000000072DE1000-0x0000000072DE4000-memory.dmp

Filesize
12KB

Download
memory/1684-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1684-61-0x0000000070861000-0x0000000070863000-memory.dmp

Filesize
8KB

Download
memory/1684-85-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1960-63-0x0000000075B31000-0x0000000075B33000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads