netwire | 6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319

General

Target

6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe
Size

403KB
MD5

593a29ce11dbd3aa281d170d43f372b1
SHA1

43e73ff7d4c8143b382dee318a50c4e9d8c5c77c
SHA256

6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319
SHA512

944c7a12b312cfde56ed3c08d424ff12cc3eb0038ac7e7f0554e560b56d13ba8de74a479a98b3b608ba8b6cd8ec733a9adda6e3c9ee21065b6ef288f84c693bb

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

chrisle79.ddns.net:4414

jacknop79.ddns.net:4414

smath79.ddns.net:4414

whatis79.ddns.net:4414

goodgt79.ddns.net:4414

bonding79.ddns.net:4414

Attributes

activex_autorun
false
activex_key
copy_executable
false
delete_original
false
host_id
June 2021
install_path
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
offline_keylogger
true
password
Password2$
registry_autorun
false
startup_name
use_mutex
false

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\oS50pe7H72PH58N4\\CFErUnnyjknZ.exe\",explorer.exe"	6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2120-115-0x0000000000400000-0x0000000000436000-memory.dmp	netwire
behavioral2/memory/2120-116-0x0000000000402453-mapping.dmp	netwire
behavioral2/memory/2120-120-0x0000000000400000-0x0000000000436000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

Processes:

6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe

description	pid	process	target process
PID 3904 set thread context of 2120	3904	6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe	AppLaunch.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

204 2120 WerFault.exe AppLaunch.exe

pid	pid_target	process	target process
204	2120	WerFault.exe	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exeWerFault.exe

pid	process
3904	6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe
3904	6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe
204	WerFault.exe
204	WerFault.exe
204	WerFault.exe
204	WerFault.exe
204	WerFault.exe
204	WerFault.exe
204	WerFault.exe
204	WerFault.exe
204	WerFault.exe
204	WerFault.exe
204	WerFault.exe
204	WerFault.exe
204	WerFault.exe
204	WerFault.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3904	6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe
Token: SeDebugPrivilege	3904	6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe
Token: SeRestorePrivilege	204	WerFault.exe
Token: SeBackupPrivilege	204	WerFault.exe
Token: SeDebugPrivilege	204	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe

description	pid	process	target process
PID 3904 wrote to memory of 2120	3904	6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe	AppLaunch.exe
PID 3904 wrote to memory of 2120	3904	6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe	AppLaunch.exe
PID 3904 wrote to memory of 2120	3904	6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe	AppLaunch.exe
PID 3904 wrote to memory of 2120	3904	6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe	AppLaunch.exe
PID 3904 wrote to memory of 2120	3904	6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe	AppLaunch.exe
PID 3904 wrote to memory of 2120	3904	6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe	AppLaunch.exe
PID 3904 wrote to memory of 2120	3904	6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe	AppLaunch.exe
PID 3904 wrote to memory of 2120	3904	6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe	AppLaunch.exe
PID 3904 wrote to memory of 2120	3904	6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe	AppLaunch.exe
PID 3904 wrote to memory of 2120	3904	6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe	AppLaunch.exe
PID 3904 wrote to memory of 2120	3904	6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe
"C:\Users\Admin\AppData\Local\Temp\6d13bcbb45eb4aaf00e63c46f6f393d879a1024be898f95d09c9d50647e76319.bin.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
2⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 484
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:204

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2120-115-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2120-116-0x0000000000402453-mapping.dmp

Download
memory/2120-117-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/2120-120-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3904-114-0x00000000030C0000-0x00000000030C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads