netwire | 30a798f90d068468a49bda1cf1dc25d8a89b6ff3acdcf3715f852bf5aba48d7f

General

Target

30a798f90d068468a49bda1cf1dc25d8a89b6ff3acdcf3715f852bf5aba48d7f.exe
Size

260KB
MD5

5d0b535797bcd3fd8b482e250e339aa6
SHA1

71d95bf3290b7f39498cd20fb983feb46f6a6d5c
SHA256

30a798f90d068468a49bda1cf1dc25d8a89b6ff3acdcf3715f852bf5aba48d7f
SHA512

ab297abcfcc8a85d59dcd749ea0eeee8ea6f8e47a78a2c99ef70f1691385109981b587dbad44391ca3fbea0a36d117c1bc2aa408475e5ef741fb8e5461075392

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2624-131-0x0000000000D00000-0x0000000000D1C000-memory.dmp	netwire
behavioral2/memory/2624-132-0x0000000000400000-0x0000000000CFA000-memory.dmp	netwire
behavioral2/memory/3400-137-0x0000000000400000-0x0000000000CFA000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

Host.exe

pid process

3400 Host.exe
Modifies Installed Components in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

pid	process
3400	Host.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

30a798f90d068468a49bda1cf1dc25d8a89b6ff3acdcf3715f852bf5aba48d7f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	30a798f90d068468a49bda1cf1dc25d8a89b6ff3acdcf3715f852bf5aba48d7f.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe"	Host.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3372 2624 WerFault.exe 30a798f90d068468a49bda1cf1dc25d8a89b6ff3acdcf3715f852bf5aba48d7f.exe

pid	pid_target	process	target process
3372	2624	WerFault.exe	30a798f90d068468a49bda1cf1dc25d8a89b6ff3acdcf3715f852bf5aba48d7f.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

30a798f90d068468a49bda1cf1dc25d8a89b6ff3acdcf3715f852bf5aba48d7f.exe

description	pid	process	target process
PID 2624 wrote to memory of 3400	2624	30a798f90d068468a49bda1cf1dc25d8a89b6ff3acdcf3715f852bf5aba48d7f.exe	Host.exe
PID 2624 wrote to memory of 3400	2624	30a798f90d068468a49bda1cf1dc25d8a89b6ff3acdcf3715f852bf5aba48d7f.exe	Host.exe
PID 2624 wrote to memory of 3400	2624	30a798f90d068468a49bda1cf1dc25d8a89b6ff3acdcf3715f852bf5aba48d7f.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\30a798f90d068468a49bda1cf1dc25d8a89b6ff3acdcf3715f852bf5aba48d7f.exe
"C:\Users\Admin\AppData\Local\Temp\30a798f90d068468a49bda1cf1dc25d8a89b6ff3acdcf3715f852bf5aba48d7f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2624

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe" -m "C:\Users\Admin\AppData\Local\Temp\30a798f90d068468a49bda1cf1dc25d8a89b6ff3acdcf3715f852bf5aba48d7f.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 1276
2⤵
- Program crash
PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2624 -ip 2624
1⤵
PID:5092

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
260KB

MD5
5d0b535797bcd3fd8b482e250e339aa6

SHA1
71d95bf3290b7f39498cd20fb983feb46f6a6d5c

SHA256
30a798f90d068468a49bda1cf1dc25d8a89b6ff3acdcf3715f852bf5aba48d7f

SHA512
ab297abcfcc8a85d59dcd749ea0eeee8ea6f8e47a78a2c99ef70f1691385109981b587dbad44391ca3fbea0a36d117c1bc2aa408475e5ef741fb8e5461075392

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
260KB

MD5
5d0b535797bcd3fd8b482e250e339aa6

SHA1
71d95bf3290b7f39498cd20fb983feb46f6a6d5c

SHA256
30a798f90d068468a49bda1cf1dc25d8a89b6ff3acdcf3715f852bf5aba48d7f

SHA512
ab297abcfcc8a85d59dcd749ea0eeee8ea6f8e47a78a2c99ef70f1691385109981b587dbad44391ca3fbea0a36d117c1bc2aa408475e5ef741fb8e5461075392

Download Submit
memory/2624-130-0x0000000000D4D000-0x0000000000D5F000-memory.dmp

Filesize
72KB

Download
memory/2624-131-0x0000000000D00000-0x0000000000D1C000-memory.dmp

Filesize
112KB

Download
memory/2624-132-0x0000000000400000-0x0000000000CFA000-memory.dmp

Filesize
9.0MB

Download
memory/3400-133-0x0000000000000000-mapping.dmp

Download
memory/3400-136-0x0000000000FFD000-0x000000000100E000-memory.dmp

Filesize
68KB

Download
memory/3400-137-0x0000000000400000-0x0000000000CFA000-memory.dmp

Filesize
9.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads