netwire | 09c5712ccf983f5013d3cd1157a15050b909b9f5f6318334e9f7da2174385015

General

Target

INV7783763278.exe
Size

690KB
MD5

0a6510aeaf92285a224cb8cb76332aeb
SHA1

106bee5b6dac97c9480fb96e99619704d9e58de1
SHA256

09c5712ccf983f5013d3cd1157a15050b909b9f5f6318334e9f7da2174385015
SHA512

bfe38ceee89109de01f7c7b63b5192bbedd34e5ef35bc4b4b8fb8e86d217761f2a05f12200b6d30503ca2c12eadd916090c54785c35656e5c9170b6eb7d830ee

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 7 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1456-68-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1456-71-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1456-70-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1456-74-0x000000000041AE7B-mapping.dmp	netwire
behavioral1/memory/1456-73-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1456-77-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1456-79-0x0000000000400000-0x0000000000450000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

INV7783763278.exe

description pid process target process

PID 1988 set thread context of 1456 1988 INV7783763278.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1280 schtasks.exe

description	pid	process	target process
PID 1988 set thread context of 1456	1988	INV7783763278.exe	vbc.exe

pid	process
1280	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

INV7783763278.exepowershell.exe

pid	process
1988	INV7783763278.exe
1988	INV7783763278.exe
1988	INV7783763278.exe
1988	INV7783763278.exe
1988	INV7783763278.exe
1988	INV7783763278.exe
1988	INV7783763278.exe
1988	INV7783763278.exe
1988	INV7783763278.exe
1988	INV7783763278.exe
1988	INV7783763278.exe
1988	INV7783763278.exe
1988	INV7783763278.exe
1988	INV7783763278.exe
1988	INV7783763278.exe
848	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

INV7783763278.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1988 INV7783763278.exe
Token: SeDebugPrivilege 848 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1988	INV7783763278.exe
Token: SeDebugPrivilege	848	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

INV7783763278.exe

description	pid	process	target process
PID 1988 wrote to memory of 848	1988	INV7783763278.exe	powershell.exe
PID 1988 wrote to memory of 848	1988	INV7783763278.exe	powershell.exe
PID 1988 wrote to memory of 848	1988	INV7783763278.exe	powershell.exe
PID 1988 wrote to memory of 848	1988	INV7783763278.exe	powershell.exe
PID 1988 wrote to memory of 1280	1988	INV7783763278.exe	schtasks.exe
PID 1988 wrote to memory of 1280	1988	INV7783763278.exe	schtasks.exe
PID 1988 wrote to memory of 1280	1988	INV7783763278.exe	schtasks.exe
PID 1988 wrote to memory of 1280	1988	INV7783763278.exe	schtasks.exe
PID 1988 wrote to memory of 592	1988	INV7783763278.exe	vbc.exe
PID 1988 wrote to memory of 592	1988	INV7783763278.exe	vbc.exe
PID 1988 wrote to memory of 592	1988	INV7783763278.exe	vbc.exe
PID 1988 wrote to memory of 592	1988	INV7783763278.exe	vbc.exe
PID 1988 wrote to memory of 1456	1988	INV7783763278.exe	vbc.exe
PID 1988 wrote to memory of 1456	1988	INV7783763278.exe	vbc.exe
PID 1988 wrote to memory of 1456	1988	INV7783763278.exe	vbc.exe
PID 1988 wrote to memory of 1456	1988	INV7783763278.exe	vbc.exe
PID 1988 wrote to memory of 1456	1988	INV7783763278.exe	vbc.exe
PID 1988 wrote to memory of 1456	1988	INV7783763278.exe	vbc.exe
PID 1988 wrote to memory of 1456	1988	INV7783763278.exe	vbc.exe
PID 1988 wrote to memory of 1456	1988	INV7783763278.exe	vbc.exe
PID 1988 wrote to memory of 1456	1988	INV7783763278.exe	vbc.exe
PID 1988 wrote to memory of 1456	1988	INV7783763278.exe	vbc.exe
PID 1988 wrote to memory of 1456	1988	INV7783763278.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\INV7783763278.exe
"C:\Users\Admin\AppData\Local\Temp\INV7783763278.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vPvuFxdhVD.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:848

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vPvuFxdhVD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6D5.tmp"
2⤵
- Creates scheduled task(s)
PID:1280

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:592

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:1456

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6D5.tmp
Filesize
1KB

MD5
2e975700a7c703871ee0e04165428a88

SHA1
21d9186ad78c44c7062c616965bb14705c03459a

SHA256
5fe5ba1ae59b2e73aec8bd78279ba28da83208907680a8b8f7ce6410b1378b7d

SHA512
d9e76984daba038e995a850ba1abb4b1adb533a91c151f4b83dba2a5bcdbf2eaa0a1348441a7653b9e44b86c1bb1fb537fe092409c505e7d1c784c57c5bbb02f

Download Submit
memory/848-58-0x0000000000000000-mapping.dmp

Download
memory/848-78-0x000000006D670000-0x000000006DC1B000-memory.dmp

Filesize
5.7MB

Download
memory/1280-59-0x0000000000000000-mapping.dmp

Download
memory/1456-63-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1456-74-0x000000000041AE7B-mapping.dmp

Download
memory/1456-79-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1456-77-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1456-73-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1456-68-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1456-66-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1456-64-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1456-71-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1456-70-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1988-57-0x0000000008040000-0x00000000080E6000-memory.dmp

Filesize
664KB

Download
memory/1988-54-0x0000000000C00000-0x0000000000CB2000-memory.dmp

Filesize
712KB

Download
memory/1988-62-0x0000000004D10000-0x0000000004D5A000-memory.dmp

Filesize
296KB

Download
memory/1988-56-0x0000000000640000-0x000000000064A000-memory.dmp

Filesize
40KB

Download
memory/1988-55-0x0000000075371000-0x0000000075373000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads