netwire | 9e94d03c8af6ca9d5ea7cfbf481970c615d0831452fe0edb2a8abcae8c190693

General

Target
9e94d03c8af6ca9d5ea7cfbf481970c615d0831452fe0edb2a8abcae8c190693.exe
Size 895KB
Sample220219-lcseesach4
SHA256 9e94d03c8af6ca9d5ea7cfbf481970c615d0831452fe0edb2a8abcae8c190693
MD5 c549db675808f888c78e3d1b72b57cdd
SHA1 7a3b11bcd1caa4b729b12fb262c2079d74bd0ece
SHA512 2486ed0c577c7e40d8e33346dacae3137d43fd0d5d46a5c1acc3187e2470a97af52b99581769484f4edaf4f5f3aa0642e49fa65126ba7ea075f9ae8b122e0a24
MD5 SHA1 SHA512

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/820-132-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Executes dropped EXE 2 IoCs

pid	Process
3644	Processname.exe
820	Processname.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	Processname.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Microsoft Corporation LYODPbcCUfHgBTeD = "C:\\Users\\Admin\\AppData\\Roaming\\LYODPbcCUfHgBTeD.exe"	Processname.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3644 set thread context of 820	3644	Processname.exe	82

autoit_exe 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000600000001e7cc-130.dat	autoit_exe
behavioral2/files/0x000600000001e7cc-131.dat	autoit_exe
behavioral2/files/0x000600000001e7cc-135.dat	autoit_exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\LYODPbcCUfHgBTeD.exe:Zone.Identifier:$DATA	Processname.exe
File created	C:\Users\Admin\AppData\Roaming\Processname.exe:Zone.Identifier:$DATA	9e94d03c8af6ca9d5ea7cfbf481970c615d0831452fe0edb2a8abcae8c190693.exe
File created	C:\Users\Admin\AppData\Roaming\LYODPbcCUfHgBTeD.exe\:Zone.Identifier:$DATA	Processname.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Processname.exe:Zone.Identifier:$DATA	Processname.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3644	Processname.exe
3644	Processname.exe
3644	Processname.exe
3644	Processname.exe
3644	Processname.exe
3644	Processname.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3184	svchost.exe
Token: SeCreatePagefilePrivilege	3184	svchost.exe
Token: SeShutdownPrivilege	3184	svchost.exe
Token: SeCreatePagefilePrivilege	3184	svchost.exe
Token: SeShutdownPrivilege	3184	svchost.exe
Token: SeCreatePagefilePrivilege	3184	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 3644	2488	9e94d03c8af6ca9d5ea7cfbf481970c615d0831452fe0edb2a8abcae8c190693.exe	81
PID 2488 wrote to memory of 3644	2488	9e94d03c8af6ca9d5ea7cfbf481970c615d0831452fe0edb2a8abcae8c190693.exe	81
PID 2488 wrote to memory of 3644	2488	9e94d03c8af6ca9d5ea7cfbf481970c615d0831452fe0edb2a8abcae8c190693.exe	81
PID 3644 wrote to memory of 820	3644	Processname.exe	82
PID 3644 wrote to memory of 820	3644	Processname.exe	82
PID 3644 wrote to memory of 820	3644	Processname.exe	82
PID 3644 wrote to memory of 820	3644	Processname.exe	82
PID 3644 wrote to memory of 820	3644	Processname.exe	82

C:\Users\Admin\AppData\Local\Temp\9e94d03c8af6ca9d5ea7cfbf481970c615d0831452fe0edb2a8abcae8c190693.exe
"C:\Users\Admin\AppData\Local\Temp\9e94d03c8af6ca9d5ea7cfbf481970c615d0831452fe0edb2a8abcae8c190693.exe"
1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Roaming\Processname.exe
  C:\Users\Admin\AppData\Roaming\Processname.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Users\Admin\AppData\Roaming\Processname.exe
    "C:\Users\Admin\AppData\Roaming\Processname.exe"
    3⤵
    - Executes dropped EXE
    PID:820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/820-132-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/3184-137-0x0000022224580000-0x0000022224590000-memory.dmp

Download

memory/3184-138-0x0000022224B20000-0x0000022224B30000-memory.dmp

Download

memory/3184-139-0x0000022227200000-0x0000022227204000-memory.dmp

Download

memory/3644-136-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads