netwire | fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c

Analysis

max time kernel
156s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
23/03/2022, 08:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe
Size 1.3MB
Sample220323-jz4pvseddp
SHA256 fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c
MD5 c8a66ac6c979fd0a037f444cccdce3e7
SHA1 2e3068676376fd70fd651e75e10c3424afc347cc
SHA512 fb403e848076d505fd8b2639850e3519c486996ba0659614e44672f42dd761479dad24c752cb1c798ed6b250934b34e6952ebc80319fa329a0ebe2ab98cb5228
MD5 SHA1 SHA512

Score

10^/10

netwire warzonerat botnet infostealer rat stealer

Malware Config

Extracted

Family

warzonerat

wealth.warzonedns.com:5202

Signatures

NetWire RAT payload 12 IoCs

rat

resource	yara_rule
behavioral2/files/0x000500000001e8b8-131.dat	netwire
behavioral2/files/0x000500000001e8b8-132.dat	netwire
behavioral2/files/0x000400000001e8c7-134.dat	netwire
behavioral2/files/0x000400000001e8c7-135.dat	netwire
behavioral2/files/0x000400000001e8c9-149.dat	netwire
behavioral2/files/0x000400000001e8c9-150.dat	netwire
behavioral2/files/0x000500000001e8b8-152.dat	netwire
behavioral2/files/0x000400000001e8c9-162.dat	netwire
behavioral2/files/0x000500000001e8b8-167.dat	netwire
behavioral2/files/0x000400000001e8c9-168.dat	netwire
behavioral2/files/0x000500000001e8b8-170.dat	netwire
behavioral2/files/0x000400000001e8c9-180.dat	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/2728-137-0x0000000001200000-0x000000000121D000-memory.dmp	warzonerat
behavioral2/memory/2728-145-0x0000000001200000-0x000000000121D000-memory.dmp	warzonerat
behavioral2/memory/3092-154-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/3092-163-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat

Executes dropped EXE 8 IoCs

pid	Process
1728	Blasthost.exe
2396	Host.exe
4628	RtDCpl64.exe
4268	Blasthost.exe
3092	RtDCpl64.exe
3224	RtDCpl64.exe
772	Blasthost.exe
4076	RtDCpl64.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	RtDCpl64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	RtDCpl64.exe

AutoIT Executable 5 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000400000001e8c9-149.dat	autoit_exe
behavioral2/files/0x000400000001e8c9-150.dat	autoit_exe
behavioral2/files/0x000400000001e8c9-162.dat	autoit_exe
behavioral2/files/0x000400000001e8c9-168.dat	autoit_exe
behavioral2/files/0x000400000001e8c9-180.dat	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 488 set thread context of 2728	488	fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe	82
PID 4628 set thread context of 3092	4628	RtDCpl64.exe	99
PID 3224 set thread context of 4076	3224	RtDCpl64.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4432	schtasks.exe
3452	schtasks.exe
424	schtasks.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 1728	488	fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe	79
PID 488 wrote to memory of 1728	488	fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe	79
PID 488 wrote to memory of 1728	488	fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe	79
PID 1728 wrote to memory of 2396	1728	Blasthost.exe	81
PID 1728 wrote to memory of 2396	1728	Blasthost.exe	81
PID 1728 wrote to memory of 2396	1728	Blasthost.exe	81
PID 488 wrote to memory of 2728	488	fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe	82
PID 488 wrote to memory of 2728	488	fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe	82
PID 488 wrote to memory of 2728	488	fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe	82
PID 488 wrote to memory of 2728	488	fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe	82
PID 488 wrote to memory of 2728	488	fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe	82
PID 2728 wrote to memory of 3280	2728	fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe	83
PID 2728 wrote to memory of 3280	2728	fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe	83
PID 2728 wrote to memory of 3280	2728	fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe	83
PID 488 wrote to memory of 4432	488	fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe	85
PID 488 wrote to memory of 4432	488	fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe	85
PID 488 wrote to memory of 4432	488	fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe	85
PID 2728 wrote to memory of 3280	2728	fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe	83
PID 2728 wrote to memory of 3280	2728	fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe	83
PID 4628 wrote to memory of 4268	4628	RtDCpl64.exe	98
PID 4628 wrote to memory of 4268	4628	RtDCpl64.exe	98
PID 4628 wrote to memory of 4268	4628	RtDCpl64.exe	98
PID 4628 wrote to memory of 3092	4628	RtDCpl64.exe	99
PID 4628 wrote to memory of 3092	4628	RtDCpl64.exe	99
PID 4628 wrote to memory of 3092	4628	RtDCpl64.exe	99
PID 4628 wrote to memory of 3092	4628	RtDCpl64.exe	99
PID 4628 wrote to memory of 3092	4628	RtDCpl64.exe	99
PID 3092 wrote to memory of 180	3092	RtDCpl64.exe	100
PID 3092 wrote to memory of 180	3092	RtDCpl64.exe	100
PID 3092 wrote to memory of 180	3092	RtDCpl64.exe	100
PID 4628 wrote to memory of 3452	4628	RtDCpl64.exe	102
PID 4628 wrote to memory of 3452	4628	RtDCpl64.exe	102
PID 4628 wrote to memory of 3452	4628	RtDCpl64.exe	102
PID 3092 wrote to memory of 180	3092	RtDCpl64.exe	100
PID 3092 wrote to memory of 180	3092	RtDCpl64.exe	100
PID 3224 wrote to memory of 772	3224	RtDCpl64.exe	105
PID 3224 wrote to memory of 772	3224	RtDCpl64.exe	105
PID 3224 wrote to memory of 772	3224	RtDCpl64.exe	105
PID 3224 wrote to memory of 4076	3224	RtDCpl64.exe	106
PID 3224 wrote to memory of 4076	3224	RtDCpl64.exe	106
PID 3224 wrote to memory of 4076	3224	RtDCpl64.exe	106
PID 3224 wrote to memory of 4076	3224	RtDCpl64.exe	106
PID 3224 wrote to memory of 4076	3224	RtDCpl64.exe	106
PID 4076 wrote to memory of 568	4076	RtDCpl64.exe	107
PID 4076 wrote to memory of 568	4076	RtDCpl64.exe	107
PID 4076 wrote to memory of 568	4076	RtDCpl64.exe	107
PID 3224 wrote to memory of 424	3224	RtDCpl64.exe	109
PID 3224 wrote to memory of 424	3224	RtDCpl64.exe	109
PID 3224 wrote to memory of 424	3224	RtDCpl64.exe	109
PID 4076 wrote to memory of 568	4076	RtDCpl64.exe	107
PID 4076 wrote to memory of 568	4076	RtDCpl64.exe	107

C:\Users\Admin\AppData\Local\Temp\fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe
"C:\Users\Admin\AppData\Local\Temp\fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:488
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
    "C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"
    3⤵
    - Executes dropped EXE
    PID:2396
- C:\Users\Admin\AppData\Local\Temp\fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe
  "C:\Users\Admin\AppData\Local\Temp\fb5f29ba7b562bb99de4c48eec30ecd7de055db7e4cae9104dca7eda41c7198c.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:3280
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4432

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:180
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:3452

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:568
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/180-166-0x0000000001360000-0x0000000001361000-memory.dmp

Download

memory/568-184-0x0000000000370000-0x0000000000371000-memory.dmp

Download

memory/2728-145-0x0000000001200000-0x000000000121D000-memory.dmp

Download

memory/2728-137-0x0000000001200000-0x000000000121D000-memory.dmp

Download

memory/3092-163-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3092-154-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3280-148-0x0000000001210000-0x0000000001211000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads