netwire | 8a5035fd03311d20137b4111bee190142fa9c653ed60e57be2802665fe8bdb24

Analysis

max time kernel
52s
max time network
148s
platform
windows7_x64
resource
win7v20210408
submitted
02/09/2021, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Attachment.exe
Size 732KB
Sample210902-vmze6aahg7
SHA256 8a5035fd03311d20137b4111bee190142fa9c653ed60e57be2802665fe8bdb24
MD5 9d4d1c7da94d5e84bca83cc2f72bb179
SHA1 a4ab57fb8374cf01e1df6eb34c6e8d2e765fe348
SHA512 abe22123caf5209b672776d2db8e566a5ccf400ccfded08089117cdbecf1028d510255db906997b931f33bee2e3067438dc48d47dfb54a9dc2950889cd3ec7f4
MD5 SHA1 SHA512

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

sinzu1.ddns.net:6655
sinzu2.ddns.net:6655
sinzu3.ddns.net:6655
sinzu4.ddns.net:6655
sinzu5.ddns.net:6655
sinzu6.ddns.net:6655
sinzu7.ddns.net:6655

Attributes

activex_autorun
false
activex_key
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
install_path
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
offline_keylogger
true
password
1234
registry_autorun
false
startup_name
use_mutex
false

Signatures

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1820-72-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Enbfwlr = "C:\\Users\\Public\\Libraries\\rlwfbnE.url"	Attachment.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
300	reg.exe
1756	reg.exe
748	reg.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1820	1080	Attachment.exe	31
PID 1080 wrote to memory of 1820	1080	Attachment.exe	31
PID 1080 wrote to memory of 1820	1080	Attachment.exe	31
PID 1080 wrote to memory of 1820	1080	Attachment.exe	31
PID 1080 wrote to memory of 1820	1080	Attachment.exe	31
PID 1080 wrote to memory of 1820	1080	Attachment.exe	31
PID 1080 wrote to memory of 1820	1080	Attachment.exe	31
PID 1080 wrote to memory of 1820	1080	Attachment.exe	31
PID 1080 wrote to memory of 1820	1080	Attachment.exe	31
PID 1080 wrote to memory of 1820	1080	Attachment.exe	31
PID 1080 wrote to memory of 1820	1080	Attachment.exe	31
PID 1080 wrote to memory of 1820	1080	Attachment.exe	31
PID 1080 wrote to memory of 1820	1080	Attachment.exe	31
PID 1080 wrote to memory of 1820	1080	Attachment.exe	31
PID 1080 wrote to memory of 1820	1080	Attachment.exe	31
PID 1080 wrote to memory of 1820	1080	Attachment.exe	31
PID 1080 wrote to memory of 1096	1080	Attachment.exe	32
PID 1080 wrote to memory of 1096	1080	Attachment.exe	32
PID 1080 wrote to memory of 1096	1080	Attachment.exe	32
PID 1080 wrote to memory of 1096	1080	Attachment.exe	32
PID 1096 wrote to memory of 2016	1096	cmd.exe	34
PID 1096 wrote to memory of 2016	1096	cmd.exe	34
PID 1096 wrote to memory of 2016	1096	cmd.exe	34
PID 1096 wrote to memory of 2016	1096	cmd.exe	34
PID 2016 wrote to memory of 300	2016	cmd.exe	36
PID 2016 wrote to memory of 300	2016	cmd.exe	36
PID 2016 wrote to memory of 300	2016	cmd.exe	36
PID 2016 wrote to memory of 300	2016	cmd.exe	36
PID 2016 wrote to memory of 1756	2016	cmd.exe	37
PID 2016 wrote to memory of 1756	2016	cmd.exe	37
PID 2016 wrote to memory of 1756	2016	cmd.exe	37
PID 2016 wrote to memory of 1756	2016	cmd.exe	37
PID 2016 wrote to memory of 952	2016	cmd.exe	38
PID 2016 wrote to memory of 952	2016	cmd.exe	38
PID 2016 wrote to memory of 952	2016	cmd.exe	38
PID 2016 wrote to memory of 952	2016	cmd.exe	38
PID 1080 wrote to memory of 792	1080	Attachment.exe	39
PID 1080 wrote to memory of 792	1080	Attachment.exe	39
PID 1080 wrote to memory of 792	1080	Attachment.exe	39
PID 1080 wrote to memory of 792	1080	Attachment.exe	39
PID 792 wrote to memory of 748	792	cmd.exe	41
PID 792 wrote to memory of 748	792	cmd.exe	41
PID 792 wrote to memory of 748	792	cmd.exe	41
PID 792 wrote to memory of 748	792	cmd.exe	41

C:\Users\Admin\AppData\Local\Temp\Attachment.exe
"C:\Users\Admin\AppData\Local\Temp\Attachment.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\mobsync.exe
  C:\Windows\System32\mobsync.exe
  2⤵
  PID:1820
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Public\Trast.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Windows\SysWOW64\reg.exe
      reg delete hkcu\Environment /v windir /f
      4⤵
      Modifies registry key
      PID:300
  - - C:\Windows\SysWOW64\reg.exe
      reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      4⤵
      Modifies registry key
      PID:1756
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      4⤵
      PID:952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Public\nest.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\SysWOW64\reg.exe
    reg delete hkcu\Environment /v windir /f
    3⤵
    - Modifies registry key
    PID:748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-61-0x0000000000300000-0x0000000000301000-memory.dmp

Download

memory/1080-60-0x0000000075801000-0x0000000075803000-memory.dmp

Download

memory/1820-68-0x00000000000A0000-0x00000000000A1000-memory.dmp

Download

memory/1820-70-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/1820-72-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1820-71-0x0000000010550000-0x0000000010585000-memory.dmp

Download

memory/1820-69-0x0000000000120000-0x0000000000121000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads