netwire | c47c4a57e7521c6886ca3764b32ad1e5d8669f2fbf6b127fe7a832f1f3b74ec5

General

Target

d058c6416284f291d6bc7e183293da1f.exe
Size

877KB
MD5

d058c6416284f291d6bc7e183293da1f
SHA1

9fe97ad0c11997b7c0ca5a43aff43cc8bdb915b6
SHA256

c47c4a57e7521c6886ca3764b32ad1e5d8669f2fbf6b127fe7a832f1f3b74ec5
SHA512

13f733fc99e5faeb274dd1480620194e88be23d70fdc108c3846cf471760a21ac8606364ed930a187b62ebedc25124488cb0557d1ced271af982d50f52fc25cd

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

podzeye.duckdns.org:6688

Attributes

activex_autorun
false
activex_key
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
install_path
keylogger_dir
lock_executable
false
mutex
offline_keylogger
false
password
Password
registry_autorun
false
startup_name
use_mutex
false

Signatures

NetWire RAT payload 7 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/972-66-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/972-67-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/972-68-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/972-69-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/972-70-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/972-71-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/972-73-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

d058c6416284f291d6bc7e183293da1f.exe

description pid process target process

PID 1620 set thread context of 972 1620 d058c6416284f291d6bc7e183293da1f.exe d058c6416284f291d6bc7e183293da1f.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1540 schtasks.exe

description	pid	process	target process
PID 1620 set thread context of 972	1620	d058c6416284f291d6bc7e183293da1f.exe	d058c6416284f291d6bc7e183293da1f.exe

pid	process
1540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

d058c6416284f291d6bc7e183293da1f.exepowershell.exe

pid	process
1620	d058c6416284f291d6bc7e183293da1f.exe
1620	d058c6416284f291d6bc7e183293da1f.exe
1620	d058c6416284f291d6bc7e183293da1f.exe
1620	d058c6416284f291d6bc7e183293da1f.exe
1620	d058c6416284f291d6bc7e183293da1f.exe
1620	d058c6416284f291d6bc7e183293da1f.exe
1620	d058c6416284f291d6bc7e183293da1f.exe
1356	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

d058c6416284f291d6bc7e183293da1f.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1620 d058c6416284f291d6bc7e183293da1f.exe
Token: SeDebugPrivilege 1356 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1620	d058c6416284f291d6bc7e183293da1f.exe
Token: SeDebugPrivilege	1356	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

d058c6416284f291d6bc7e183293da1f.exe

C:\Users\Admin\AppData\Local\Temp\d058c6416284f291d6bc7e183293da1f.exe
"C:\Users\Admin\AppData\Local\Temp\d058c6416284f291d6bc7e183293da1f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SiEKNQVnm.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1356

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SiEKNQVnm" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB8C4.tmp"
2⤵
- Creates scheduled task(s)
PID:1540

C:\Users\Admin\AppData\Local\Temp\d058c6416284f291d6bc7e183293da1f.exe
"C:\Users\Admin\AppData\Local\Temp\d058c6416284f291d6bc7e183293da1f.exe"
2⤵
PID:972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB8C4.tmp
MD5
423522604505339e51da767ecd98fc0e

SHA1
f1ef5b1790b204b08ce47ad88f614d63db9ef015

SHA256
0d7e73404baf6c94fed56b918fb76254e968b6f50011650432f9fdb3de4a3f23

SHA512
993b823716475db6114b3c7e452fa5b84ab2b7729bd67b3ee060afd90d56c0b52e109e0be9e51ffb9f41997dcb57db0afcdc00741cbb25c3f37ee331373eb6d5

Download Submit
memory/972-69-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/972-66-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/972-63-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/972-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/972-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/972-71-0x000000000040242D-mapping.dmp

Download
memory/972-70-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/972-68-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/972-67-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/972-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1356-74-0x0000000002470000-0x00000000030BA000-memory.dmp

Filesize
12.3MB

Download
memory/1356-61-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1356-59-0x0000000000000000-mapping.dmp

Download
memory/1540-60-0x0000000000000000-mapping.dmp

Download
memory/1620-56-0x0000000004850000-0x0000000004851000-memory.dmp

Filesize
4KB

Download
memory/1620-57-0x0000000000250000-0x000000000025E000-memory.dmp

Filesize
56KB

Download
memory/1620-55-0x0000000000280000-0x0000000000360000-memory.dmp

Filesize
896KB

Download
memory/1620-54-0x0000000000280000-0x0000000000360000-memory.dmp

Filesize
896KB

Download
memory/1620-58-0x0000000002220000-0x000000000227E000-memory.dmp

Filesize
376KB

Download

description	pid	process	target process
PID 1620 wrote to memory of 1356	1620	d058c6416284f291d6bc7e183293da1f.exe	powershell.exe
PID 1620 wrote to memory of 1356	1620	d058c6416284f291d6bc7e183293da1f.exe	powershell.exe
PID 1620 wrote to memory of 1356	1620	d058c6416284f291d6bc7e183293da1f.exe	powershell.exe
PID 1620 wrote to memory of 1356	1620	d058c6416284f291d6bc7e183293da1f.exe	powershell.exe
PID 1620 wrote to memory of 1540	1620	d058c6416284f291d6bc7e183293da1f.exe	schtasks.exe
PID 1620 wrote to memory of 1540	1620	d058c6416284f291d6bc7e183293da1f.exe	schtasks.exe
PID 1620 wrote to memory of 1540	1620	d058c6416284f291d6bc7e183293da1f.exe	schtasks.exe
PID 1620 wrote to memory of 1540	1620	d058c6416284f291d6bc7e183293da1f.exe	schtasks.exe
PID 1620 wrote to memory of 972	1620	d058c6416284f291d6bc7e183293da1f.exe	d058c6416284f291d6bc7e183293da1f.exe
PID 1620 wrote to memory of 972	1620	d058c6416284f291d6bc7e183293da1f.exe	d058c6416284f291d6bc7e183293da1f.exe
PID 1620 wrote to memory of 972	1620	d058c6416284f291d6bc7e183293da1f.exe	d058c6416284f291d6bc7e183293da1f.exe
PID 1620 wrote to memory of 972	1620	d058c6416284f291d6bc7e183293da1f.exe	d058c6416284f291d6bc7e183293da1f.exe
PID 1620 wrote to memory of 972	1620	d058c6416284f291d6bc7e183293da1f.exe	d058c6416284f291d6bc7e183293da1f.exe
PID 1620 wrote to memory of 972	1620	d058c6416284f291d6bc7e183293da1f.exe	d058c6416284f291d6bc7e183293da1f.exe
PID 1620 wrote to memory of 972	1620	d058c6416284f291d6bc7e183293da1f.exe	d058c6416284f291d6bc7e183293da1f.exe
PID 1620 wrote to memory of 972	1620	d058c6416284f291d6bc7e183293da1f.exe	d058c6416284f291d6bc7e183293da1f.exe
PID 1620 wrote to memory of 972	1620	d058c6416284f291d6bc7e183293da1f.exe	d058c6416284f291d6bc7e183293da1f.exe
PID 1620 wrote to memory of 972	1620	d058c6416284f291d6bc7e183293da1f.exe	d058c6416284f291d6bc7e183293da1f.exe
PID 1620 wrote to memory of 972	1620	d058c6416284f291d6bc7e183293da1f.exe	d058c6416284f291d6bc7e183293da1f.exe
PID 1620 wrote to memory of 972	1620	d058c6416284f291d6bc7e183293da1f.exe	d058c6416284f291d6bc7e183293da1f.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads