netwire | 7601552d259cf367d16f624395dfdd29121b837595d0b80869f6ac2b7f6f5418

General

Target

M5UG7W1B.exe
Size

424KB
MD5

0da7c19fbcd9c3b0362754bbfccbcd79
SHA1

3d28a2974f0691a0fcb2ffd291b700518f6b9ac7
SHA256

35c080693f92425ef536a0b1bec2f1c1f975575da18a8c54cb16a47f97ce1d79
SHA512

88bd35861bef6e7a6db4c65baef4a32631068f6adaf99dda2d7ee93e9529729049429cc7df4eb0d64d968869d8d91051f87438bc53db49dc1c4087e17bcbf8d1

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

194.5.98.225:3373

194.5.98.225:3376

Attributes

activex_autorun
false
activex_key
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
install_path
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
offline_keylogger
true
password
good01230123
registry_autorun
false
startup_name
use_mutex
false

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1500-137-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/1500-139-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/1500-140-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

M5UG7W1B.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	M5UG7W1B.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

M5UG7W1B.exe

description pid process target process

PID 3172 set thread context of 1500 3172 M5UG7W1B.exe M5UG7W1B.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4752 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

M5UG7W1B.exe

pid process

3172 M5UG7W1B.exe
3172 M5UG7W1B.exe
3172 M5UG7W1B.exe
3172 M5UG7W1B.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

M5UG7W1B.exe

description pid process

Token: SeDebugPrivilege 3172 M5UG7W1B.exe

description	pid	process	target process
PID 3172 set thread context of 1500	3172	M5UG7W1B.exe	M5UG7W1B.exe

pid	process
4752	schtasks.exe

pid	process
3172	M5UG7W1B.exe
3172	M5UG7W1B.exe
3172	M5UG7W1B.exe
3172	M5UG7W1B.exe

description	pid	process
Token: SeDebugPrivilege	3172	M5UG7W1B.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

M5UG7W1B.exe

description	pid	process	target process
PID 3172 wrote to memory of 4752	3172	M5UG7W1B.exe	schtasks.exe
PID 3172 wrote to memory of 4752	3172	M5UG7W1B.exe	schtasks.exe
PID 3172 wrote to memory of 4752	3172	M5UG7W1B.exe	schtasks.exe
PID 3172 wrote to memory of 1500	3172	M5UG7W1B.exe	M5UG7W1B.exe
PID 3172 wrote to memory of 1500	3172	M5UG7W1B.exe	M5UG7W1B.exe
PID 3172 wrote to memory of 1500	3172	M5UG7W1B.exe	M5UG7W1B.exe
PID 3172 wrote to memory of 1500	3172	M5UG7W1B.exe	M5UG7W1B.exe
PID 3172 wrote to memory of 1500	3172	M5UG7W1B.exe	M5UG7W1B.exe
PID 3172 wrote to memory of 1500	3172	M5UG7W1B.exe	M5UG7W1B.exe
PID 3172 wrote to memory of 1500	3172	M5UG7W1B.exe	M5UG7W1B.exe
PID 3172 wrote to memory of 1500	3172	M5UG7W1B.exe	M5UG7W1B.exe
PID 3172 wrote to memory of 1500	3172	M5UG7W1B.exe	M5UG7W1B.exe
PID 3172 wrote to memory of 1500	3172	M5UG7W1B.exe	M5UG7W1B.exe
PID 3172 wrote to memory of 1500	3172	M5UG7W1B.exe	M5UG7W1B.exe

C:\Users\Admin\AppData\Local\Temp\M5UG7W1B.exe
"C:\Users\Admin\AppData\Local\Temp\M5UG7W1B.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3172

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EulvjaSjRNp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp57F3.tmp"
2⤵
- Creates scheduled task(s)
PID:4752

C:\Users\Admin\AppData\Local\Temp\M5UG7W1B.exe
"{path}"
2⤵
PID:1500

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp57F3.tmp
Filesize
1KB

MD5
c5382ac04b50225560d55f14fe04355a

SHA1
26d228a8ab143efd708d75c0ca53f31633923168

SHA256
60f2585083ccc0df2e02d541609974711057ad0a87e764871d7c4b8badcb7e6b

SHA512
94680a65fcdcf6c63c93ff9331b7164de70af51efd6f6c02289766b4615a7b3b38f09cd233f79b6ee72e9aa809973cbb87af5c23c3a102e4c198a56757fd2bae

Download Submit
memory/1500-136-0x0000000000000000-mapping.dmp

Download
memory/1500-137-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1500-139-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1500-140-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3172-130-0x0000000000630000-0x00000000006A0000-memory.dmp

Filesize
448KB

Download
memory/3172-131-0x0000000005680000-0x0000000005C24000-memory.dmp

Filesize
5.6MB

Download
memory/3172-132-0x00000000050D0000-0x0000000005162000-memory.dmp

Filesize
584KB

Download
memory/3172-133-0x0000000005E20000-0x0000000005EBC000-memory.dmp

Filesize
624KB

Download
memory/4752-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads