netwire | 7601552d259cf367d16f624395dfdd29121b837595d0b80869f6ac2b7f6f5418

General

Target

M5UG7W1B.exe
Size

424KB
MD5

0da7c19fbcd9c3b0362754bbfccbcd79
SHA1

3d28a2974f0691a0fcb2ffd291b700518f6b9ac7
SHA256

35c080693f92425ef536a0b1bec2f1c1f975575da18a8c54cb16a47f97ce1d79
SHA512

88bd35861bef6e7a6db4c65baef4a32631068f6adaf99dda2d7ee93e9529729049429cc7df4eb0d64d968869d8d91051f87438bc53db49dc1c4087e17bcbf8d1

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

194.5.98.225:3373

194.5.98.225:3376

Attributes

activex_autorun
false
activex_key
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
install_path
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
offline_keylogger
true
password
good01230123
registry_autorun
false
startup_name
use_mutex
false

Signatures

NetWire RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1596-66-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1596-67-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1596-68-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1596-70-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1596-71-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1596-72-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1596-75-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1596-76-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

M5UG7W1B.exe

description pid process target process

PID 2036 set thread context of 1596 2036 M5UG7W1B.exe M5UG7W1B.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1660 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

M5UG7W1B.exe

pid process

2036 M5UG7W1B.exe
2036 M5UG7W1B.exe
2036 M5UG7W1B.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

M5UG7W1B.exe

description pid process

Token: SeDebugPrivilege 2036 M5UG7W1B.exe

description	pid	process	target process
PID 2036 set thread context of 1596	2036	M5UG7W1B.exe	M5UG7W1B.exe

pid	process
1660	schtasks.exe

pid	process
2036	M5UG7W1B.exe
2036	M5UG7W1B.exe
2036	M5UG7W1B.exe

description	pid	process
Token: SeDebugPrivilege	2036	M5UG7W1B.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

M5UG7W1B.exe

description	pid	process	target process
PID 2036 wrote to memory of 1660	2036	M5UG7W1B.exe	schtasks.exe
PID 2036 wrote to memory of 1660	2036	M5UG7W1B.exe	schtasks.exe
PID 2036 wrote to memory of 1660	2036	M5UG7W1B.exe	schtasks.exe
PID 2036 wrote to memory of 1660	2036	M5UG7W1B.exe	schtasks.exe
PID 2036 wrote to memory of 1596	2036	M5UG7W1B.exe	M5UG7W1B.exe
PID 2036 wrote to memory of 1596	2036	M5UG7W1B.exe	M5UG7W1B.exe
PID 2036 wrote to memory of 1596	2036	M5UG7W1B.exe	M5UG7W1B.exe
PID 2036 wrote to memory of 1596	2036	M5UG7W1B.exe	M5UG7W1B.exe
PID 2036 wrote to memory of 1596	2036	M5UG7W1B.exe	M5UG7W1B.exe
PID 2036 wrote to memory of 1596	2036	M5UG7W1B.exe	M5UG7W1B.exe
PID 2036 wrote to memory of 1596	2036	M5UG7W1B.exe	M5UG7W1B.exe
PID 2036 wrote to memory of 1596	2036	M5UG7W1B.exe	M5UG7W1B.exe
PID 2036 wrote to memory of 1596	2036	M5UG7W1B.exe	M5UG7W1B.exe
PID 2036 wrote to memory of 1596	2036	M5UG7W1B.exe	M5UG7W1B.exe
PID 2036 wrote to memory of 1596	2036	M5UG7W1B.exe	M5UG7W1B.exe
PID 2036 wrote to memory of 1596	2036	M5UG7W1B.exe	M5UG7W1B.exe

C:\Users\Admin\AppData\Local\Temp\M5UG7W1B.exe
"C:\Users\Admin\AppData\Local\Temp\M5UG7W1B.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EulvjaSjRNp" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD366.tmp"
2⤵
- Creates scheduled task(s)
PID:1660

C:\Users\Admin\AppData\Local\Temp\M5UG7W1B.exe
"{path}"
2⤵
PID:1596

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD366.tmp
Filesize
1KB

MD5
14d021bbe0f0e74defe83808c1cf0ed9

SHA1
330f427a76e497f07973ed488584e3a06c09cd90

SHA256
244c7d4ac2c9c0131e8d5f0c511fae3cfbf19236d52180812944c4a92327f6e5

SHA512
649920fd9c496ba375e6b2d963071ef7230b14891c29d725718b220594c5b37a4fdb4f3f36a07a82859f38a8a2e5d24aed47129edf5c00edf53f28ead2b04f8b

Download Submit
memory/1596-68-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1596-70-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1596-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1596-76-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1596-66-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1596-75-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1596-61-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1596-67-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1596-72-0x000000000040242D-mapping.dmp

Download
memory/1596-71-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1596-62-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1660-59-0x0000000000000000-mapping.dmp

Download
memory/2036-54-0x0000000001000000-0x0000000001070000-memory.dmp

Filesize
448KB

Download
memory/2036-56-0x0000000004A00000-0x0000000004A60000-memory.dmp

Filesize
384KB

Download
memory/2036-57-0x0000000004980000-0x00000000049CC000-memory.dmp

Filesize
304KB

Download
memory/2036-55-0x00000000001F0000-0x00000000001FA000-memory.dmp

Filesize
40KB

Download
memory/2036-58-0x0000000075C01000-0x0000000075C03000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads