netwire | 9add495b9373ca17ea4f158da84a200f3d5a52ce81bc535a575a5eac31bd76bb

Analysis

max time kernel
104s
max time network
122s
platform
windows10_x64
resource
win10v20210408
submitted
21/07/2021, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
order.exe
Size 838KB
Sample210721-e187tf5w1x
SHA256 9add495b9373ca17ea4f158da84a200f3d5a52ce81bc535a575a5eac31bd76bb
MD5 587f6655380282c9fb7997fa2225438e
SHA1 5b45eb58ef1d1cd93df0ecfc7b4124644515e93c
SHA512 1b97c465d355d8fa6355c7b856ba7eebac8b8c4bdd9c482b1a8fa6c558309356cfb80ac3373737b269c1ca9c4df03294daee918a34500e45874c1b6fc32ce488
MD5 SHA1 SHA512

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

84.38.129.130:19891

Attributes

activex_autorun
false
activex_key
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
iFwvrEFs
offline_keylogger
true
password
Password
registry_autorun
false
startup_name
use_mutex
true

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/1280-139-0x00000000053F0000-0x00000000058EE000-memory.dmp	disable_win_def

NetWire RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/1032-126-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/1032-127-0x000000000040242D-mapping.dmp	netwire
behavioral2/memory/1032-138-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/2500-145-0x000000000040242D-mapping.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Executes dropped EXE 2 IoCs

pid	Process
1280	Host.exe
2500	Host.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4796 set thread context of 1032	4796	order.exe	82
PID 1280 set thread context of 2500	1280	Host.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
580	schtasks.exe
1344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4796	order.exe
4796	order.exe
4796	order.exe
4796	order.exe
4796	order.exe
1280	Host.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	order.exe
Token: SeDebugPrivilege	1280	Host.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 580	4796	order.exe	78
PID 4796 wrote to memory of 580	4796	order.exe	78
PID 4796 wrote to memory of 580	4796	order.exe	78
PID 4796 wrote to memory of 476	4796	order.exe	80
PID 4796 wrote to memory of 476	4796	order.exe	80
PID 4796 wrote to memory of 476	4796	order.exe	80
PID 4796 wrote to memory of 860	4796	order.exe	81
PID 4796 wrote to memory of 860	4796	order.exe	81
PID 4796 wrote to memory of 860	4796	order.exe	81
PID 4796 wrote to memory of 1032	4796	order.exe	82
PID 4796 wrote to memory of 1032	4796	order.exe	82
PID 4796 wrote to memory of 1032	4796	order.exe	82
PID 4796 wrote to memory of 1032	4796	order.exe	82
PID 4796 wrote to memory of 1032	4796	order.exe	82
PID 4796 wrote to memory of 1032	4796	order.exe	82
PID 4796 wrote to memory of 1032	4796	order.exe	82
PID 4796 wrote to memory of 1032	4796	order.exe	82
PID 4796 wrote to memory of 1032	4796	order.exe	82
PID 4796 wrote to memory of 1032	4796	order.exe	82
PID 4796 wrote to memory of 1032	4796	order.exe	82
PID 1032 wrote to memory of 1280	1032	order.exe	83
PID 1032 wrote to memory of 1280	1032	order.exe	83
PID 1032 wrote to memory of 1280	1032	order.exe	83
PID 1280 wrote to memory of 1344	1280	Host.exe	84
PID 1280 wrote to memory of 1344	1280	Host.exe	84
PID 1280 wrote to memory of 1344	1280	Host.exe	84
PID 1280 wrote to memory of 2500	1280	Host.exe	86
PID 1280 wrote to memory of 2500	1280	Host.exe	86
PID 1280 wrote to memory of 2500	1280	Host.exe	86
PID 1280 wrote to memory of 2500	1280	Host.exe	86
PID 1280 wrote to memory of 2500	1280	Host.exe	86
PID 1280 wrote to memory of 2500	1280	Host.exe	86
PID 1280 wrote to memory of 2500	1280	Host.exe	86
PID 1280 wrote to memory of 2500	1280	Host.exe	86
PID 1280 wrote to memory of 2500	1280	Host.exe	86
PID 1280 wrote to memory of 2500	1280	Host.exe	86
PID 1280 wrote to memory of 2500	1280	Host.exe	86

C:\Users\Admin\AppData\Local\Temp\order.exe
"C:\Users\Admin\AppData\Local\Temp\order.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BFzyfsQWtX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5F95.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:580
- C:\Users\Admin\AppData\Local\Temp\order.exe
  "{path}"
  2⤵
  PID:476
- C:\Users\Admin\AppData\Local\Temp\order.exe
  "{path}"
  2⤵
  PID:860
- C:\Users\Admin\AppData\Local\Temp\order.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Users\Admin\AppData\Roaming\Install\Host.exe
    "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1280
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BFzyfsQWtX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2017.tmp"
      4⤵
      Creates scheduled task(s)
      PID:1344
  - - C:\Users\Admin\AppData\Roaming\Install\Host.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:2500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-138-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1032-126-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1280-139-0x00000000053F0000-0x00000000058EE000-memory.dmp

Download

memory/4796-118-0x0000000005880000-0x0000000005D7E000-memory.dmp

Download

memory/4796-123-0x0000000007590000-0x00000000075FF000-memory.dmp

Download

memory/4796-122-0x0000000007390000-0x0000000007443000-memory.dmp

Download

memory/4796-117-0x0000000005880000-0x0000000005881000-memory.dmp

Download

memory/4796-114-0x0000000000F10000-0x0000000000F11000-memory.dmp

Download

memory/4796-119-0x0000000005810000-0x0000000005811000-memory.dmp

Download

memory/4796-121-0x0000000008D20000-0x0000000008D21000-memory.dmp

Download

memory/4796-116-0x0000000005D80000-0x0000000005D81000-memory.dmp

Download

memory/4796-120-0x0000000005A80000-0x0000000005A82000-memory.dmp

Download