netwire | 62f36cc4ec3591ca9db78a063f6f215746f453f1181c64c0adda032ea86c53fd

Analysis

max time kernel
118s
max time network
122s
platform
windows10_x64
resource
win10-en-20211014
submitted
19/11/2021, 08:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
Size 897KB
Sample211119-kmk8escha2
SHA256 62f36cc4ec3591ca9db78a063f6f215746f453f1181c64c0adda032ea86c53fd
MD5 01b041871098ef1238050957aa38c3ab
SHA1 2ad0159ac58bcb21fa78386196d244288f333359
SHA512 dec94ede1d3abfc65bb2e79b9acb55cdbcf1bb4fddebe686f57016862f1408528e47f4fdfeaed076a909d032d051c12ef9618d191cea2c24000bbfa6329f98fa
MD5 SHA1 SHA512

Score

10^/10

netwire xmrig botnet miner persistence rat stealer

Malware Config

Extracted

Family

netwire

sftp21.duckdns.org:5114
sftp22.duckdns.org:5114
sftp23.duckdns.org:5114
sftp24.duckdns.org:5114
sftp25.duckdns.org:5114

Attributes

activex_autorun
false
activex_key
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
install_path
keylogger_dir
lock_executable
true
mutex
mDIjUvnN
offline_keylogger
false
password
Password
registry_autorun
false
startup_name
use_mutex
true

Signatures

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2852-129-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ipylezsr = "C:\\Users\\Public\\Libraries\\Ipylezsr\\rszelypI.url"	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\A:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\L:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\M:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\N:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\V:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\W:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\Y:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\H:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\J:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\O:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\Q:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\R:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\S:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\Z:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\F:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\G:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\I:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\K:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\T:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\U:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\X:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\B:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
File opened (read-only)	\??\E:	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\logagent.exe	logagent.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
1220	reg.exe
400	reg.exe
376	reg.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2852	2800	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe	69
PID 2800 wrote to memory of 2852	2800	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe	69
PID 2800 wrote to memory of 2852	2800	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe	69
PID 2800 wrote to memory of 2852	2800	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe	69
PID 2800 wrote to memory of 2852	2800	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe	69
PID 2800 wrote to memory of 2852	2800	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe	69
PID 2800 wrote to memory of 2852	2800	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe	69
PID 2800 wrote to memory of 2852	2800	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe	69
PID 2800 wrote to memory of 2852	2800	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe	69
PID 2800 wrote to memory of 2852	2800	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe	69
PID 2800 wrote to memory of 2852	2800	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe	69
PID 2800 wrote to memory of 2852	2800	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe	69
PID 2800 wrote to memory of 2852	2800	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe	69
PID 2800 wrote to memory of 2852	2800	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe	69
PID 2800 wrote to memory of 2852	2800	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe	69
PID 2800 wrote to memory of 68	2800	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe	70
PID 2800 wrote to memory of 68	2800	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe	70
PID 2800 wrote to memory of 68	2800	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe	70
PID 68 wrote to memory of 1576	68	cmd.exe	72
PID 68 wrote to memory of 1576	68	cmd.exe	72
PID 68 wrote to memory of 1576	68	cmd.exe	72
PID 1576 wrote to memory of 400	1576	cmd.exe	74
PID 1576 wrote to memory of 400	1576	cmd.exe	74
PID 1576 wrote to memory of 400	1576	cmd.exe	74
PID 1576 wrote to memory of 376	1576	cmd.exe	75
PID 1576 wrote to memory of 376	1576	cmd.exe	75
PID 1576 wrote to memory of 376	1576	cmd.exe	75
PID 1576 wrote to memory of 680	1576	cmd.exe	76
PID 1576 wrote to memory of 680	1576	cmd.exe	76
PID 1576 wrote to memory of 680	1576	cmd.exe	76
PID 2800 wrote to memory of 3164	2800	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe	77
PID 2800 wrote to memory of 3164	2800	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe	77
PID 2800 wrote to memory of 3164	2800	Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe	77
PID 3164 wrote to memory of 1220	3164	cmd.exe	79
PID 3164 wrote to memory of 1220	3164	cmd.exe	79
PID 3164 wrote to memory of 1220	3164	cmd.exe	79

C:\Users\Admin\AppData\Local\Temp\Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe
"C:\Users\Admin\AppData\Local\Temp\Ipylezsrtczpnsdrafrrtowlhyalarezpo.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\logagent.exe
  C:\Windows\System32\logagent.exe
  2⤵
  - Drops file in System32 directory
  PID:2852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:68
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1576
  - - C:\Windows\SysWOW64\reg.exe
      reg delete hkcu\Environment /v windir /f
      4⤵
      Modifies registry key
      PID:400
  - - C:\Windows\SysWOW64\reg.exe
      reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      4⤵
      Modifies registry key
      PID:376
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      4⤵
      PID:680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\SysWOW64\reg.exe
    reg delete hkcu\Environment /v windir /f
    3⤵
    - Modifies registry key
    PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2800-116-0x00000000007D1000-0x00000000007E5000-memory.dmp

Download

memory/2800-115-0x00000000006A0000-0x00000000006A1000-memory.dmp

Download

memory/2852-119-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

Download

memory/2852-121-0x00000000725C0000-0x00000000725F5000-memory.dmp

Download

memory/2852-129-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2852-118-0x0000000002ED0000-0x0000000002ED1000-memory.dmp

Download

memory/2852-120-0x0000000002F30000-0x0000000002F31000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads