netwire | 9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d

Analysis

max time kernel
77s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
26/02/2022, 07:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe
Size 341KB
Sample220226-h5597sbbem
SHA256 9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d
MD5 b864067e3fa697652752fcd54f2b0621
SHA1 b9c2af989e2a4665df92e734bf7e1894ad9b873f
SHA512 6e37f92c0833881d8a533e5d696d536af4c10b0b835f5c65d979961a07784ea70ca9ae2942248a32251a892eef296e6c5f9f19ebf71d373320cb5e78a1d8eac5
MD5 SHA1 SHA512

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

185.244.29.161:1591

Attributes

activex_autorun
false
activex_key
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
NeiqFfto
offline_keylogger
true
password
Password
registry_autorun
false
startup_name
use_mutex
true

Signatures

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/424-136-0x0000000004B10000-0x0000000004B40000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3964 created 424	3964	WerFault.exe	68

Executes dropped EXE 1 IoCs

pid	Process
424	svhost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2768 set thread context of 424	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	68

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	424	WerFault.exe	68

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2280	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe
2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe
3056	WerFault.exe
3056	WerFault.exe
2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe
2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe
Token: SeRestorePrivilege	3056	WerFault.exe
Token: SeBackupPrivilege	3056	WerFault.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 424	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	68
PID 2768 wrote to memory of 424	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	68
PID 2768 wrote to memory of 424	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	68
PID 2768 wrote to memory of 424	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	68
PID 2768 wrote to memory of 424	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	68
PID 2768 wrote to memory of 424	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	68
PID 2768 wrote to memory of 424	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	68
PID 2768 wrote to memory of 424	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	68
PID 2768 wrote to memory of 424	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	68
PID 2768 wrote to memory of 424	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	68
PID 3964 wrote to memory of 424	3964	WerFault.exe	68
PID 3964 wrote to memory of 424	3964	WerFault.exe	68
PID 2768 wrote to memory of 2568	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	75
PID 2768 wrote to memory of 2568	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	75
PID 2768 wrote to memory of 2568	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	75
PID 2768 wrote to memory of 1812	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	77
PID 2768 wrote to memory of 1812	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	77
PID 2768 wrote to memory of 1812	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	77
PID 1812 wrote to memory of 4060	1812	cmd.exe	79
PID 1812 wrote to memory of 4060	1812	cmd.exe	79
PID 1812 wrote to memory of 4060	1812	cmd.exe	79
PID 2768 wrote to memory of 1028	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	80
PID 2768 wrote to memory of 1028	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	80
PID 2768 wrote to memory of 1028	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	80
PID 2768 wrote to memory of 1256	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	82
PID 2768 wrote to memory of 1256	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	82
PID 2768 wrote to memory of 1256	2768	9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe	82
PID 1256 wrote to memory of 2280	1256	cmd.exe	84
PID 1256 wrote to memory of 2280	1256	cmd.exe	84
PID 1256 wrote to memory of 2280	1256	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe
"C:\Users\Admin\AppData\Local\Temp\9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  PID:424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 344
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3056
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d.exe" "%temp%\FolderN\name.exe" /Y
  2⤵
  PID:2568
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f
    3⤵
    PID:4060
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
  2⤵
  - NTFS ADS
  PID:1028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 300
    3⤵
    - Delays execution with timeout.exe
    PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 424 -ip 424
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:3964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/424-134-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/424-136-0x0000000004B10000-0x0000000004B40000-memory.dmp

Download

memory/2768-130-0x00000000748CE000-0x00000000748CF000-memory.dmp

Download

memory/2768-131-0x0000000000960000-0x00000000009BC000-memory.dmp

Download

memory/2768-132-0x00000000053C0000-0x000000000545C000-memory.dmp

Download

memory/2768-133-0x00000000054B0000-0x00000000054B1000-memory.dmp

Download