netwire | b0842f8285062f38c030bdd15264ec38fb23624888d135121f1cc11084c765ba

General

Target
Traffic Finesinvoice 276252728736533737.pdf .exe
Size 831KB
Sample220307-rwbhxaabgr
SHA256 b0842f8285062f38c030bdd15264ec38fb23624888d135121f1cc11084c765ba
MD5 7ecd214c9401e42e11d566e2eb6f083d
SHA1 8fbbbba5da8ff97cf2b44cd267f903597baa8cfc
SHA512 1a734ef5c45c2cd17a1181c7bc7b193040c52a2545dc9d3c6de8ca7b3cb946e95b40887480415482c5ba18fe2476119228121bbbca464b69e535ba5f5ea9fe3f
MD5 SHA1 SHA512

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/2124-138-0x00000000725D0000-0x0000000072617000-memory.dmp	netwire
behavioral2/memory/2124-139-0x0000000000400000-0x0000000000444000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Stnrbde = "C:\\Users\\Public\\edbrntS.url"	Traffic Finesinvoice 276252728736533737.pdf .exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 2124	488	Traffic Finesinvoice 276252728736533737.pdf .exe	79
PID 488 wrote to memory of 2124	488	Traffic Finesinvoice 276252728736533737.pdf .exe	79
PID 488 wrote to memory of 2124	488	Traffic Finesinvoice 276252728736533737.pdf .exe	79
PID 488 wrote to memory of 2124	488	Traffic Finesinvoice 276252728736533737.pdf .exe	79
PID 488 wrote to memory of 2124	488	Traffic Finesinvoice 276252728736533737.pdf .exe	79
PID 488 wrote to memory of 2124	488	Traffic Finesinvoice 276252728736533737.pdf .exe	79
PID 488 wrote to memory of 2124	488	Traffic Finesinvoice 276252728736533737.pdf .exe	79
PID 488 wrote to memory of 2124	488	Traffic Finesinvoice 276252728736533737.pdf .exe	79
PID 488 wrote to memory of 2124	488	Traffic Finesinvoice 276252728736533737.pdf .exe	79
PID 488 wrote to memory of 2124	488	Traffic Finesinvoice 276252728736533737.pdf .exe	79
PID 488 wrote to memory of 2124	488	Traffic Finesinvoice 276252728736533737.pdf .exe	79
PID 488 wrote to memory of 2124	488	Traffic Finesinvoice 276252728736533737.pdf .exe	79
PID 488 wrote to memory of 2124	488	Traffic Finesinvoice 276252728736533737.pdf .exe	79
PID 488 wrote to memory of 2124	488	Traffic Finesinvoice 276252728736533737.pdf .exe	79
PID 488 wrote to memory of 2124	488	Traffic Finesinvoice 276252728736533737.pdf .exe	79

C:\Users\Admin\AppData\Local\Temp\Traffic Finesinvoice 276252728736533737.pdf .exe
"C:\Users\Admin\AppData\Local\Temp\Traffic Finesinvoice 276252728736533737.pdf .exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:488
- C:\Windows\SysWOW64\logagent.exe
  C:\Windows\System32\logagent.exe
  2⤵
  PID:2124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/488-131-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/488-132-0x0000000000400000-0x00000000004D5000-memory.dmp

Download

memory/488-134-0x0000000003EE6000-0x0000000003EE7000-memory.dmp

Download

memory/2124-136-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/2124-135-0x00000000009F0000-0x00000000009F1000-memory.dmp

Download

memory/2124-137-0x0000000000C10000-0x0000000000C11000-memory.dmp

Download

memory/2124-138-0x00000000725D0000-0x0000000072617000-memory.dmp

Download

memory/2124-139-0x0000000000400000-0x0000000000444000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads