netwire | a5552237bf0ede9675b646aea11141c7763ed882fc8dbfe1b036f6347fe98ad3

General

Target
PAY-IN-006.exe
Size 495KB
Sample220228-k5l8fadhb4
SHA256 a5552237bf0ede9675b646aea11141c7763ed882fc8dbfe1b036f6347fe98ad3
MD5 b48f191956b17605899eec0ae1ae255e
SHA1 3596126e49ff1ca312b8a2c036976d6f44a5cdbf
SHA512 a686323d7d2c6ef0858f2b7cfc20de8d49a2dda723dfd8b50d84677d9a29dc3b52046c2e4b964445d594f6a358abe11a7e89e95a63e4e33f9e7fcba27c6f3cf8
MD5 SHA1 SHA512

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

194.147.140.14:4550

Attributes

activex_autorun
false
activex_key
copy_executable
false
delete_original
false
host_id
THANA
install_path
keylogger_dir
lock_executable
false
mutex
offline_keylogger
false
password
DrvbK8mdyY4F6Uh
registry_autorun
false
startup_name
�ЪY��m��tD�
use_mutex
false

Signatures

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/832-134-0x0000000000400000-0x0000000000444000-memory.dmp	netwire
behavioral2/memory/832-136-0x0000000000400000-0x0000000000444000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Executes dropped EXE 2 IoCs

pid	Process
4580	ovxufjxjbx.exe
832	ovxufjxjbx.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hqduamc = "C:\\Users\\Admin\\AppData\\Roaming\\tjxruxolpube\\sjdyafkdcai.exe"	ovxufjxjbx.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4580 set thread context of 832	4580	ovxufjxjbx.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 4580	3048	PAY-IN-006.exe	79
PID 3048 wrote to memory of 4580	3048	PAY-IN-006.exe	79
PID 3048 wrote to memory of 4580	3048	PAY-IN-006.exe	79
PID 4580 wrote to memory of 832	4580	ovxufjxjbx.exe	80
PID 4580 wrote to memory of 832	4580	ovxufjxjbx.exe	80
PID 4580 wrote to memory of 832	4580	ovxufjxjbx.exe	80
PID 4580 wrote to memory of 832	4580	ovxufjxjbx.exe	80
PID 4580 wrote to memory of 832	4580	ovxufjxjbx.exe	80
PID 4580 wrote to memory of 832	4580	ovxufjxjbx.exe	80
PID 4580 wrote to memory of 832	4580	ovxufjxjbx.exe	80
PID 4580 wrote to memory of 832	4580	ovxufjxjbx.exe	80
PID 4580 wrote to memory of 832	4580	ovxufjxjbx.exe	80
PID 4580 wrote to memory of 832	4580	ovxufjxjbx.exe	80
PID 4580 wrote to memory of 832	4580	ovxufjxjbx.exe	80
PID 4580 wrote to memory of 832	4580	ovxufjxjbx.exe	80
PID 4580 wrote to memory of 832	4580	ovxufjxjbx.exe	80

C:\Users\Admin\AppData\Local\Temp\PAY-IN-006.exe
"C:\Users\Admin\AppData\Local\Temp\PAY-IN-006.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\ovxufjxjbx.exe
  C:\Users\Admin\AppData\Local\Temp\ovxufjxjbx.exe C:\Users\Admin\AppData\Local\Temp\npyoqck
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Users\Admin\AppData\Local\Temp\ovxufjxjbx.exe
    C:\Users\Admin\AppData\Local\Temp\ovxufjxjbx.exe C:\Users\Admin\AppData\Local\Temp\npyoqck
    3⤵
    - Executes dropped EXE
    PID:832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/832-134-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/832-136-0x0000000000400000-0x0000000000444000-memory.dmp