netwire | f7d7c3c283891a3fdffccf5dbd1da3a841064cd393aed4eab3987dfb1d93a51c

General

Target

BANK_DET.exe
Size

434KB
MD5

97c8146c10d533dacaaca193761b1c98
SHA1

dff81aa37ff7d60095615682ded6490f188ae959
SHA256

3c7e44e2b240655a3f18fde494d90ba07478b3e28f0161f63ecfd48049a7d554
SHA512

e387b91b904e4d29de77c196cf32541b26e968341be4011b386504f47c737ad066bba23b428464a2f2ca516c5f9fc1f88d14e25c5dfc497f4a3bb9c1f72038d4

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2652-145-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Blocklisted process makes network request 2 IoCs

Processes:

cmd.exe

flow pid process

36 2652 cmd.exe
37 2652 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1476 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1476 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1476 rundll32.exe

flow	pid	process
36	2652	cmd.exe
37	2652	cmd.exe

pid	process
1476	rundll32.exe

pid	process
1476	rundll32.exe

pid	process
1476	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

BANK_DET.exerundll32.exe

description	pid	process	target process
PID 2860 wrote to memory of 1476	2860	BANK_DET.exe	rundll32.exe
PID 2860 wrote to memory of 1476	2860	BANK_DET.exe	rundll32.exe
PID 2860 wrote to memory of 1476	2860	BANK_DET.exe	rundll32.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe
PID 1476 wrote to memory of 2652	1476	rundll32.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\BANK_DET.exe
"C:\Users\Admin\AppData\Local\Temp\BANK_DET.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe Pentagon,Maia
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Blocklisted process makes network request
PID:2652

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Helenium
Filesize
176KB

MD5
958c339f8ed8b251838ff8d5d3ab52aa

SHA1
d840cd535392c97a4a2a51630a34a0a1d85eea1f

SHA256
a2a46b00c8bf3b05d08c6d52e0ecc106637426c7eb7ab4c6d02910a38591f905

SHA512
40856851c12c11c669f8935909e6cbd78133df17ba0e4d8c7ddc9730abd178e875347e52e3a5503e31b7a3449912843e859132272485b9e33a2e8cfe648e8c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pentagon.DLL
Filesize
56KB

MD5
84efccfc8c97ebda74559a289f41c769

SHA1
5325f8b9e8a20a0ac8911f48b6f744c69665650a

SHA256
0515fa8a1ed1d74e440cb372c981b8e3b703fe5c1593e26deaba5a47704cebc8

SHA512
8c0845739ee37d658c91899f947604cbd69c126e9e0cfc6af275a007ef99802cf86e4af4af180b4a14a786aec9645144f737dafb87543c7d3faa13544888e66b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pentagon.dll
Filesize
56KB

MD5
84efccfc8c97ebda74559a289f41c769

SHA1
5325f8b9e8a20a0ac8911f48b6f744c69665650a

SHA256
0515fa8a1ed1d74e440cb372c981b8e3b703fe5c1593e26deaba5a47704cebc8

SHA512
8c0845739ee37d658c91899f947604cbd69c126e9e0cfc6af275a007ef99802cf86e4af4af180b4a14a786aec9645144f737dafb87543c7d3faa13544888e66b

Download Submit
memory/1476-130-0x0000000000000000-mapping.dmp

Download
memory/1476-134-0x0000000074AA0000-0x0000000074B68000-memory.dmp

Filesize
800KB

Download
memory/1476-135-0x0000000076470000-0x00000000764D3000-memory.dmp

Filesize
396KB

Download
memory/1476-136-0x00007FF8DC950000-0x00007FF8DCB45000-memory.dmp

Filesize
2.0MB

Download
memory/1476-137-0x0000000001590000-0x0000000001593000-memory.dmp

Filesize
12KB

Download
memory/2652-138-0x0000000000000000-mapping.dmp

Download
memory/2652-139-0x0000000000FF0000-0x0000000000FF6000-memory.dmp

Filesize
24KB

Download
memory/2652-140-0x00007FF8DC950000-0x00007FF8DCB45000-memory.dmp

Filesize
2.0MB

Download
memory/2652-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing