netwire | c24ceed8f4fa062af34c785cbafb72b8efd029131d0df391de76b2f9dcded675

General

Target
INVOICE-F0774.exe
Size 600KB
Sample220227-mnfqfacac6
SHA256 c24ceed8f4fa062af34c785cbafb72b8efd029131d0df391de76b2f9dcded675
MD5 4f75b1a5494625220adcdb8f81440064
SHA1 fb2215c6e82d566c4be6ff1a94e0e869d86d22ab
SHA512 d241a6b782ca36ede56e9d2e2aca8267ee46aa36c60204a72a31b2026099174257b92cb9871a0553de61f79664c4fc66eb04ea67501c6c0f98ab0d541d0bd7b5
MD5 SHA1 SHA512

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

onelove03.duckdns.org:3382

Attributes

activex_autorun
false
activex_key
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
CwTYUOXt
offline_keylogger
true
password
onelove82
registry_autorun
true
startup_name
NetWire
use_mutex
true

Signatures

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/556-135-0x0000000000400000-0x0000000000497000-memory.dmp	netwire
behavioral2/memory/556-137-0x0000000000400000-0x000000000042B000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Executes dropped EXE 2 IoCs

pid	Process
3356	Host.exe
3660	Host.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	INVOICE-F0774.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe"	Host.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
1164	INVOICE-F0774.exe
556	INVOICE-F0774.exe
556	INVOICE-F0774.exe
3356	Host.exe
3660	Host.exe
3660	Host.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1164 set thread context of 556	1164	INVOICE-F0774.exe	66
PID 3356 set thread context of 3660	3356	Host.exe	73

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1164	INVOICE-F0774.exe
3356	Host.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 556	1164	INVOICE-F0774.exe	66
PID 1164 wrote to memory of 556	1164	INVOICE-F0774.exe	66
PID 1164 wrote to memory of 556	1164	INVOICE-F0774.exe	66
PID 556 wrote to memory of 3356	556	INVOICE-F0774.exe	70
PID 556 wrote to memory of 3356	556	INVOICE-F0774.exe	70
PID 556 wrote to memory of 3356	556	INVOICE-F0774.exe	70
PID 3356 wrote to memory of 3660	3356	Host.exe	73
PID 3356 wrote to memory of 3660	3356	Host.exe	73
PID 3356 wrote to memory of 3660	3356	Host.exe	73

C:\Users\Admin\AppData\Local\Temp\INVOICE-F0774.exe
"C:\Users\Admin\AppData\Local\Temp\INVOICE-F0774.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Users\Admin\AppData\Local\Temp\INVOICE-F0774.exe
  "C:\Users\Admin\AppData\Local\Temp\INVOICE-F0774.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Users\Admin\AppData\Roaming\Install\Host.exe
    "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\Users\Admin\AppData\Roaming\Install\Host.exe
      "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:3660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/556-135-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/556-137-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/556-140-0x0000000000401000-0x000000000041C000-memory.dmp

Download

memory/1164-132-0x0000000002260000-0x000000000226F000-memory.dmp

Download

memory/1164-133-0x00007FFCB37B1000-0x00007FFCB38CA000-memory.dmp

Download

memory/1164-134-0x0000000077DB1000-0x0000000077ED1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads