netwire | 3ce133222e75c154a06fbc81d2c85307ad5a4d843fa0ec322018a9061e489c5d

General

Target
acfd95d7e65a6dcc4f1180a954f9bcc3.exe
Size 704KB
Sample220220-ya81lsbfa7
SHA256 3ce133222e75c154a06fbc81d2c85307ad5a4d843fa0ec322018a9061e489c5d
MD5 acfd95d7e65a6dcc4f1180a954f9bcc3
SHA1 d82fcd858674accb015f63eb9f98dc6f252abce2
SHA512 1e18cf1a988c463eddeae7464c3a73bfa4ca27513d34d69469e56f6e4fd23f939bad6d0dbb7170ca39005863499a872de9221660e2f08b9bfcfe50aae3b0600a
MD5 SHA1 SHA512

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/4572-140-0x00000000725C0000-0x00000000725F5000-memory.dmp	netwire
behavioral2/memory/4572-141-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Uclwijtx = "C:\\Users\\Admin\\xtjiwlcU.url"	acfd95d7e65a6dcc4f1180a954f9bcc3.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3116	svchost.exe
Token: SeCreatePagefilePrivilege	3116	svchost.exe
Token: SeShutdownPrivilege	3116	svchost.exe
Token: SeCreatePagefilePrivilege	3116	svchost.exe
Token: SeShutdownPrivilege	3116	svchost.exe
Token: SeCreatePagefilePrivilege	3116	svchost.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 4572	808	acfd95d7e65a6dcc4f1180a954f9bcc3.exe	91
PID 808 wrote to memory of 4572	808	acfd95d7e65a6dcc4f1180a954f9bcc3.exe	91
PID 808 wrote to memory of 4572	808	acfd95d7e65a6dcc4f1180a954f9bcc3.exe	91
PID 808 wrote to memory of 4572	808	acfd95d7e65a6dcc4f1180a954f9bcc3.exe	91
PID 808 wrote to memory of 4572	808	acfd95d7e65a6dcc4f1180a954f9bcc3.exe	91
PID 808 wrote to memory of 4572	808	acfd95d7e65a6dcc4f1180a954f9bcc3.exe	91
PID 808 wrote to memory of 4572	808	acfd95d7e65a6dcc4f1180a954f9bcc3.exe	91
PID 808 wrote to memory of 4572	808	acfd95d7e65a6dcc4f1180a954f9bcc3.exe	91
PID 808 wrote to memory of 4572	808	acfd95d7e65a6dcc4f1180a954f9bcc3.exe	91
PID 808 wrote to memory of 4572	808	acfd95d7e65a6dcc4f1180a954f9bcc3.exe	91
PID 808 wrote to memory of 4572	808	acfd95d7e65a6dcc4f1180a954f9bcc3.exe	91
PID 808 wrote to memory of 4572	808	acfd95d7e65a6dcc4f1180a954f9bcc3.exe	91
PID 808 wrote to memory of 4572	808	acfd95d7e65a6dcc4f1180a954f9bcc3.exe	91
PID 808 wrote to memory of 4572	808	acfd95d7e65a6dcc4f1180a954f9bcc3.exe	91
PID 808 wrote to memory of 4572	808	acfd95d7e65a6dcc4f1180a954f9bcc3.exe	91

C:\Users\Admin\AppData\Local\Temp\acfd95d7e65a6dcc4f1180a954f9bcc3.exe
"C:\Users\Admin\AppData\Local\Temp\acfd95d7e65a6dcc4f1180a954f9bcc3.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\SysWOW64\logagent.exe
  C:\Windows\System32\logagent.exe
  2⤵
  PID:4572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-131-0x0000000000670000-0x0000000000671000-memory.dmp

Download

memory/808-136-0x0000000003C96000-0x0000000003C97000-memory.dmp

Download

memory/3116-132-0x00000171C7E20000-0x00000171C7E30000-memory.dmp

Download

memory/3116-133-0x00000171C7E80000-0x00000171C7E90000-memory.dmp

Download

memory/3116-134-0x00000171CA550000-0x00000171CA554000-memory.dmp

Download

memory/4572-138-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Download

memory/4572-137-0x0000000000C20000-0x0000000000C21000-memory.dmp

Download

memory/4572-139-0x0000000000C40000-0x0000000000C41000-memory.dmp

Download

memory/4572-140-0x00000000725C0000-0x00000000725F5000-memory.dmp

Download

memory/4572-141-0x0000000000400000-0x0000000000433000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads