netwire | 289b1b674ae1d8ebd1693294b8f14560195fa8948c61b21478fa75aaa3d76301

General

Target

PO-13916.jpeg.exe
Size

23KB
MD5

43132b52987daa1e94acd4fba098cc55
SHA1

8080d8db03455a2b82fadb74c15d573e7519390a
SHA256

289b1b674ae1d8ebd1693294b8f14560195fa8948c61b21478fa75aaa3d76301
SHA512

5e544b288d309e98b8e2e3dc8316e0ec0c09f96cfa4ca76a8d163ef3f846dcd6748c6f1f569303a363c715725987dac1b5993f8ba8212d06b2cefd9ad34efcff

Score

10^/10

netwire botnet evasion rat stealer trojan

Malware Config

Extracted

Family

netwire

C2

netwire.linkpc.net:6000

Attributes

activex_autorun
false
activex_key
copy_executable
false
delete_original
false
host_id
NETWIRE 2021
install_path
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
PXVtYqoX
offline_keylogger
true
password
chizzy25@
registry_autorun
false
startup_name
use_mutex
true

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2784-166-0x0000000000400000-0x0000000000434000-memory.dmp	netwire
behavioral2/memory/2784-167-0x000000000040242D-mapping.dmp	netwire
behavioral2/memory/2784-168-0x0000000000400000-0x0000000000434000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

PO-13916.jpeg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	PO-13916.jpeg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	PO-13916.jpeg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\ꔲꔱꔔꔀꔀꔱꔱꔱꔵꔁꔄꔆꔰꔂꔱꔰꔂꔕꔂꔱꔩꔖꔴꔗꔰꔲꔔꔃꔂꔲꔲꔰꕁꔰꔴꔕꔅꕁꔀꔱ\svchost.exe = "0"	PO-13916.jpeg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\PO-13916.jpeg.exe = "0"	PO-13916.jpeg.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

PO-13916.jpeg.exe

description pid process target process

PID 3008 set thread context of 2784 3008 PO-13916.jpeg.exe PO-13916.jpeg.exe

description	pid	process	target process
PID 3008 set thread context of 2784	3008	PO-13916.jpeg.exe	PO-13916.jpeg.exe

Drops file in Windows directory 2 IoCs

Processes:

PO-13916.jpeg.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework\ꔲꔱꔔꔀꔀꔱꔱꔱꔵꔁꔄꔆꔰꔂꔱꔰꔂꔕꔂꔱꔩꔖꔴꔗꔰꔲꔔꔃꔂꔲꔲꔰꕁꔰꔴꔕꔅꕁꔀꔱ\svchost.exe	PO-13916.jpeg.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\ꔲꔱꔔꔀꔀꔱꔱꔱꔵꔁꔄꔆꔰꔂꔱꔰꔂꔕꔂꔱꔩꔖꔴꔗꔰꔲꔔꔃꔂꔲꔲꔰꕁꔰꔴꔕꔅꕁꔀꔱ\svchost.exe	PO-13916.jpeg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid	process
1124	powershell.exe
3936	powershell.exe
3500	powershell.exe
1124	powershell.exe
3500	powershell.exe
3936	powershell.exe
3500	powershell.exe
3936	powershell.exe
1124	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

PO-13916.jpeg.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3008	PO-13916.jpeg.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	3500	powershell.exe
Token: SeDebugPrivilege	3936	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

PO-13916.jpeg.exe

description	pid	process	target process
PID 3008 wrote to memory of 3500	3008	PO-13916.jpeg.exe	powershell.exe
PID 3008 wrote to memory of 3500	3008	PO-13916.jpeg.exe	powershell.exe
PID 3008 wrote to memory of 3500	3008	PO-13916.jpeg.exe	powershell.exe
PID 3008 wrote to memory of 1124	3008	PO-13916.jpeg.exe	powershell.exe
PID 3008 wrote to memory of 1124	3008	PO-13916.jpeg.exe	powershell.exe
PID 3008 wrote to memory of 1124	3008	PO-13916.jpeg.exe	powershell.exe
PID 3008 wrote to memory of 3936	3008	PO-13916.jpeg.exe	powershell.exe
PID 3008 wrote to memory of 3936	3008	PO-13916.jpeg.exe	powershell.exe
PID 3008 wrote to memory of 3936	3008	PO-13916.jpeg.exe	powershell.exe
PID 3008 wrote to memory of 2784	3008	PO-13916.jpeg.exe	PO-13916.jpeg.exe
PID 3008 wrote to memory of 2784	3008	PO-13916.jpeg.exe	PO-13916.jpeg.exe
PID 3008 wrote to memory of 2784	3008	PO-13916.jpeg.exe	PO-13916.jpeg.exe
PID 3008 wrote to memory of 2784	3008	PO-13916.jpeg.exe	PO-13916.jpeg.exe
PID 3008 wrote to memory of 2784	3008	PO-13916.jpeg.exe	PO-13916.jpeg.exe
PID 3008 wrote to memory of 2784	3008	PO-13916.jpeg.exe	PO-13916.jpeg.exe
PID 3008 wrote to memory of 2784	3008	PO-13916.jpeg.exe	PO-13916.jpeg.exe
PID 3008 wrote to memory of 2784	3008	PO-13916.jpeg.exe	PO-13916.jpeg.exe
PID 3008 wrote to memory of 2784	3008	PO-13916.jpeg.exe	PO-13916.jpeg.exe
PID 3008 wrote to memory of 2784	3008	PO-13916.jpeg.exe	PO-13916.jpeg.exe
PID 3008 wrote to memory of 2784	3008	PO-13916.jpeg.exe	PO-13916.jpeg.exe
PID 3008 wrote to memory of 2784	3008	PO-13916.jpeg.exe	PO-13916.jpeg.exe

C:\Users\Admin\AppData\Local\Temp\PO-13916.jpeg.exe
"C:\Users\Admin\AppData\Local\Temp\PO-13916.jpeg.exe"
1⤵
- Windows security modification
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\ꔲꔱꔔꔀꔀꔱꔱꔱꔵꔁꔄꔆꔰꔂꔱꔰꔂꔕꔂꔱꔩꔖꔴꔗꔰꔲꔔꔃꔂꔲꔲꔰꕁꔰꔴꔕꔅꕁꔀꔱ\svchost.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3500

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO-13916.jpeg.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1124

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\ꔲꔱꔔꔀꔀꔱꔱꔱꔵꔁꔄꔆꔰꔂꔱꔰꔂꔕꔂꔱꔩꔖꔴꔗꔰꔲꔔꔃꔂꔲꔲꔰꕁꔰꔴꔕꔅꕁꔀꔱ\svchost.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3936

C:\Users\Admin\AppData\Local\Temp\PO-13916.jpeg.exe
"C:\Users\Admin\AppData\Local\Temp\PO-13916.jpeg.exe"
2⤵
PID:2784

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

2

T1089

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
3aae1978d850bddf0f348bb234a8c434

SHA1
0234b3ffda10a12c09f3c972647b7163f15dca2f

SHA256
000aba75c1cc2a60f6f06c03d5270cc47148026631189e138d55c1ce164274ad

SHA512
b10f85993173f3e8bd83e16461e33914a04aa4968e1f76af3dacc2ebb147f054abe861cedd08b0a74710de30fa69b013c029414bce18f037f8994a410112483f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
3aae1978d850bddf0f348bb234a8c434

SHA1
0234b3ffda10a12c09f3c972647b7163f15dca2f

SHA256
000aba75c1cc2a60f6f06c03d5270cc47148026631189e138d55c1ce164274ad

SHA512
b10f85993173f3e8bd83e16461e33914a04aa4968e1f76af3dacc2ebb147f054abe861cedd08b0a74710de30fa69b013c029414bce18f037f8994a410112483f

Download Submit
memory/1124-203-0x000000007F710000-0x000000007F711000-memory.dmp

Filesize
4KB

Download
memory/1124-235-0x0000000007443000-0x0000000007444000-memory.dmp

Filesize
4KB

Download
memory/1124-144-0x0000000007442000-0x0000000007443000-memory.dmp

Filesize
4KB

Download
memory/1124-123-0x0000000000000000-mapping.dmp

Download
memory/1124-140-0x0000000007440000-0x0000000007441000-memory.dmp

Filesize
4KB

Download
memory/1124-130-0x0000000007390000-0x0000000007391000-memory.dmp

Filesize
4KB

Download
memory/2784-167-0x000000000040242D-mapping.dmp

Download
memory/2784-168-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2784-166-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3008-117-0x0000000005760000-0x0000000005761000-memory.dmp

Filesize
4KB

Download
memory/3008-134-0x0000000006520000-0x0000000006521000-memory.dmp

Filesize
4KB

Download
memory/3008-139-0x00000000064D0000-0x00000000064D1000-memory.dmp

Filesize
4KB

Download
memory/3008-116-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download
memory/3008-118-0x00000000061C0000-0x00000000061C1000-memory.dmp

Filesize
4KB

Download
memory/3008-121-0x0000000006340000-0x0000000006341000-memory.dmp

Filesize
4KB

Download
memory/3008-120-0x0000000006750000-0x0000000006751000-memory.dmp

Filesize
4KB

Download
memory/3008-114-0x0000000000E50000-0x0000000000E51000-memory.dmp

Filesize
4KB

Download
memory/3008-119-0x00000000061E0000-0x000000000622F000-memory.dmp

Filesize
316KB

Download
memory/3500-143-0x0000000000CD2000-0x0000000000CD3000-memory.dmp

Filesize
4KB

Download
memory/3500-207-0x000000007EB80000-0x000000007EB81000-memory.dmp

Filesize
4KB

Download
memory/3500-151-0x0000000007230000-0x0000000007231000-memory.dmp

Filesize
4KB

Download
memory/3500-122-0x0000000000000000-mapping.dmp

Download
memory/3500-238-0x0000000000CD3000-0x0000000000CD4000-memory.dmp

Filesize
4KB

Download
memory/3500-160-0x0000000007930000-0x0000000007931000-memory.dmp

Filesize
4KB

Download
memory/3500-135-0x0000000006B90000-0x0000000006B91000-memory.dmp

Filesize
4KB

Download
memory/3500-211-0x00000000067A0000-0x00000000067A1000-memory.dmp

Filesize
4KB

Download
memory/3500-138-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/3936-191-0x0000000009600000-0x0000000009633000-memory.dmp

Filesize
204KB

Download
memory/3936-141-0x0000000007110000-0x0000000007111000-memory.dmp

Filesize
4KB

Download
memory/3936-148-0x0000000007E40000-0x0000000007E41000-memory.dmp

Filesize
4KB

Download
memory/3936-142-0x0000000007112000-0x0000000007113000-memory.dmp

Filesize
4KB

Download
memory/3936-210-0x000000007F460000-0x000000007F461000-memory.dmp

Filesize
4KB

Download
memory/3936-145-0x0000000007ED0000-0x0000000007ED1000-memory.dmp

Filesize
4KB

Download
memory/3936-236-0x0000000007113000-0x0000000007114000-memory.dmp

Filesize
4KB

Download
memory/3936-157-0x0000000007FC0000-0x0000000007FC1000-memory.dmp

Filesize
4KB

Download
memory/3936-124-0x0000000000000000-mapping.dmp

Download
memory/3936-154-0x0000000008020000-0x0000000008021000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads