netwire | 8a5035fd03311d20137b4111bee190142fa9c653ed60e57be2802665fe8bdb24

Analysis

max time kernel
77s
max time network
148s
platform
windows10_x64
resource
win10v20210408
submitted
02/09/2021, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Attachment.exe
Size 732KB
Sample210902-vmze6aahg7
SHA256 8a5035fd03311d20137b4111bee190142fa9c653ed60e57be2802665fe8bdb24
MD5 9d4d1c7da94d5e84bca83cc2f72bb179
SHA1 a4ab57fb8374cf01e1df6eb34c6e8d2e765fe348
SHA512 abe22123caf5209b672776d2db8e566a5ccf400ccfded08089117cdbecf1028d510255db906997b931f33bee2e3067438dc48d47dfb54a9dc2950889cd3ec7f4
MD5 SHA1 SHA512

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

sinzu1.ddns.net:6655
sinzu2.ddns.net:6655
sinzu3.ddns.net:6655
sinzu4.ddns.net:6655
sinzu5.ddns.net:6655
sinzu6.ddns.net:6655
sinzu7.ddns.net:6655

Attributes

activex_autorun
false
activex_key
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
install_path
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
offline_keylogger
true
password
1234
registry_autorun
false
startup_name
use_mutex
false

Signatures

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1860-123-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Blocklisted process makes network request 1 IoCs

flow	pid	Process
24	1860	mshta.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Enbfwlr = "C:\\Users\\Public\\Libraries\\rlwfbnE.url"	Attachment.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
2240	reg.exe
3484	reg.exe
716	reg.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 1860	664	Attachment.exe	78
PID 664 wrote to memory of 1860	664	Attachment.exe	78
PID 664 wrote to memory of 1860	664	Attachment.exe	78
PID 664 wrote to memory of 1860	664	Attachment.exe	78
PID 664 wrote to memory of 1860	664	Attachment.exe	78
PID 664 wrote to memory of 1860	664	Attachment.exe	78
PID 664 wrote to memory of 1860	664	Attachment.exe	78
PID 664 wrote to memory of 1860	664	Attachment.exe	78
PID 664 wrote to memory of 1860	664	Attachment.exe	78
PID 664 wrote to memory of 1860	664	Attachment.exe	78
PID 664 wrote to memory of 1860	664	Attachment.exe	78
PID 664 wrote to memory of 1860	664	Attachment.exe	78
PID 664 wrote to memory of 1860	664	Attachment.exe	78
PID 664 wrote to memory of 1860	664	Attachment.exe	78
PID 664 wrote to memory of 1860	664	Attachment.exe	78
PID 664 wrote to memory of 3164	664	Attachment.exe	79
PID 664 wrote to memory of 3164	664	Attachment.exe	79
PID 664 wrote to memory of 3164	664	Attachment.exe	79
PID 3164 wrote to memory of 2116	3164	cmd.exe	81
PID 3164 wrote to memory of 2116	3164	cmd.exe	81
PID 3164 wrote to memory of 2116	3164	cmd.exe	81
PID 2116 wrote to memory of 2240	2116	cmd.exe	83
PID 2116 wrote to memory of 2240	2116	cmd.exe	83
PID 2116 wrote to memory of 2240	2116	cmd.exe	83
PID 2116 wrote to memory of 3484	2116	cmd.exe	84
PID 2116 wrote to memory of 3484	2116	cmd.exe	84
PID 2116 wrote to memory of 3484	2116	cmd.exe	84
PID 2116 wrote to memory of 892	2116	cmd.exe	85
PID 2116 wrote to memory of 892	2116	cmd.exe	85
PID 2116 wrote to memory of 892	2116	cmd.exe	85
PID 664 wrote to memory of 3700	664	Attachment.exe	86
PID 664 wrote to memory of 3700	664	Attachment.exe	86
PID 664 wrote to memory of 3700	664	Attachment.exe	86
PID 3700 wrote to memory of 716	3700	cmd.exe	88
PID 3700 wrote to memory of 716	3700	cmd.exe	88
PID 3700 wrote to memory of 716	3700	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\Attachment.exe
"C:\Users\Admin\AppData\Local\Temp\Attachment.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:664
- C:\Windows\SysWOW64\mshta.exe
  C:\Windows\System32\mshta.exe
  2⤵
  - Blocklisted process makes network request
  PID:1860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\SysWOW64\reg.exe
      reg delete hkcu\Environment /v windir /f
      4⤵
      Modifies registry key
      PID:2240
  - - C:\Windows\SysWOW64\reg.exe
      reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      4⤵
      Modifies registry key
      PID:3484
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      4⤵
      PID:892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\SysWOW64\reg.exe
    reg delete hkcu\Environment /v windir /f
    3⤵
    - Modifies registry key
    PID:716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/664-114-0x0000000000680000-0x0000000000681000-memory.dmp

Download

memory/1860-120-0x0000000002F20000-0x0000000002F21000-memory.dmp

Download

memory/1860-122-0x0000000010550000-0x0000000010585000-memory.dmp

Download

memory/1860-121-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Download

memory/1860-119-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/1860-123-0x0000000000400000-0x0000000000433000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads