netwire | 9add495b9373ca17ea4f158da84a200f3d5a52ce81bc535a575a5eac31bd76bb

Analysis

max time kernel
122s
max time network
164s
platform
windows7_x64
resource
win7v20210410
submitted
21/07/2021, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
order.exe
Size 838KB
Sample210721-e187tf5w1x
SHA256 9add495b9373ca17ea4f158da84a200f3d5a52ce81bc535a575a5eac31bd76bb
MD5 587f6655380282c9fb7997fa2225438e
SHA1 5b45eb58ef1d1cd93df0ecfc7b4124644515e93c
SHA512 1b97c465d355d8fa6355c7b856ba7eebac8b8c4bdd9c482b1a8fa6c558309356cfb80ac3373737b269c1ca9c4df03294daee918a34500e45874c1b6fc32ce488
MD5 SHA1 SHA512

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

84.38.129.130:19891

Attributes

activex_autorun
false
activex_key
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
iFwvrEFs
offline_keylogger
true
password
Password
registry_autorun
false
startup_name
use_mutex
true

Signatures

NetWire RAT payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/1504-68-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1504-69-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1504-74-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1784-85-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1784-88-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Executes dropped EXE 2 IoCs

pid	Process
616	Host.exe
1784	Host.exe

Loads dropped DLL 1 IoCs

pid	Process
1504	order.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1304 set thread context of 1504	1304	order.exe	31
PID 616 set thread context of 1784	616	Host.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
268	schtasks.exe
1064	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
616	Host.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1304	order.exe
Token: SeDebugPrivilege	616	Host.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 268	1304	order.exe	29
PID 1304 wrote to memory of 268	1304	order.exe	29
PID 1304 wrote to memory of 268	1304	order.exe	29
PID 1304 wrote to memory of 268	1304	order.exe	29
PID 1304 wrote to memory of 1504	1304	order.exe	31
PID 1304 wrote to memory of 1504	1304	order.exe	31
PID 1304 wrote to memory of 1504	1304	order.exe	31
PID 1304 wrote to memory of 1504	1304	order.exe	31
PID 1304 wrote to memory of 1504	1304	order.exe	31
PID 1304 wrote to memory of 1504	1304	order.exe	31
PID 1304 wrote to memory of 1504	1304	order.exe	31
PID 1304 wrote to memory of 1504	1304	order.exe	31
PID 1304 wrote to memory of 1504	1304	order.exe	31
PID 1304 wrote to memory of 1504	1304	order.exe	31
PID 1304 wrote to memory of 1504	1304	order.exe	31
PID 1304 wrote to memory of 1504	1304	order.exe	31
PID 1504 wrote to memory of 616	1504	order.exe	32
PID 1504 wrote to memory of 616	1504	order.exe	32
PID 1504 wrote to memory of 616	1504	order.exe	32
PID 1504 wrote to memory of 616	1504	order.exe	32
PID 616 wrote to memory of 1064	616	Host.exe	33
PID 616 wrote to memory of 1064	616	Host.exe	33
PID 616 wrote to memory of 1064	616	Host.exe	33
PID 616 wrote to memory of 1064	616	Host.exe	33
PID 616 wrote to memory of 1784	616	Host.exe	35
PID 616 wrote to memory of 1784	616	Host.exe	35
PID 616 wrote to memory of 1784	616	Host.exe	35
PID 616 wrote to memory of 1784	616	Host.exe	35
PID 616 wrote to memory of 1784	616	Host.exe	35
PID 616 wrote to memory of 1784	616	Host.exe	35
PID 616 wrote to memory of 1784	616	Host.exe	35
PID 616 wrote to memory of 1784	616	Host.exe	35
PID 616 wrote to memory of 1784	616	Host.exe	35
PID 616 wrote to memory of 1784	616	Host.exe	35
PID 616 wrote to memory of 1784	616	Host.exe	35
PID 616 wrote to memory of 1784	616	Host.exe	35

C:\Users\Admin\AppData\Local\Temp\order.exe
"C:\Users\Admin\AppData\Local\Temp\order.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BFzyfsQWtX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp71C6.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:268
- C:\Users\Admin\AppData\Local\Temp\order.exe
  "{path}"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Users\Admin\AppData\Roaming\Install\Host.exe
    "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:616
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BFzyfsQWtX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2E9F.tmp"
      4⤵
      Creates scheduled task(s)
      PID:1064
  - - C:\Users\Admin\AppData\Roaming\Install\Host.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:1784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/616-79-0x00000000050D0000-0x00000000050D1000-memory.dmp

Download

memory/616-76-0x0000000000F20000-0x0000000000F21000-memory.dmp

Download

memory/1304-60-0x0000000000060000-0x0000000000061000-memory.dmp

Download

memory/1304-65-0x000000000A4F0000-0x000000000A55F000-memory.dmp

Download

memory/1304-64-0x0000000007D70000-0x0000000007E23000-memory.dmp

Download

memory/1304-63-0x00000000005C0000-0x00000000005C2000-memory.dmp

Download

memory/1304-62-0x0000000004C20000-0x0000000004C21000-memory.dmp

Download

memory/1504-74-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1504-68-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1504-70-0x0000000075551000-0x0000000075553000-memory.dmp

Download

memory/1784-88-0x0000000000400000-0x0000000000433000-memory.dmp

Download