netwire | f8d54d69a3d89f5417af6ac2438e70fc598501d612b6f96df412975927f31c1b

General

Target

OrderList.exe
Size

616KB
MD5

1337cd4ad86e2a55d005dd32fdbe03f9
SHA1

a0a23d6ecb8c6a60503d0b593165310a6f8a1ab1
SHA256

be148ec34c1a4adc8afa7bd26f7951dc5f11984d07024a10b4af1c285f38b588
SHA512

8f83ecd25d858f35eb382254e87b45de11a0a884a88ab5fbf4938338ec185a5a8d9ec3dda04abc798d0355e65eedbbfccf7613315bf1962d08b095aecaa748fe

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

gold1.dnsupdate.info:4770

79.134.225.79:4770

Attributes

activex_autorun
false
activex_key
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
install_path
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
offline_keylogger
true
password
Password
registry_autorun
false
startup_name
use_mutex
false

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4164-134-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/4164-136-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/4164-137-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

OrderList.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	OrderList.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

OrderList.exe

description pid process target process

PID 3308 set thread context of 4164 3308 OrderList.exe OrderList.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4612 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

OrderList.exe

pid process

3308 OrderList.exe
3308 OrderList.exe
3308 OrderList.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

OrderList.exe

description pid process

Token: SeDebugPrivilege 3308 OrderList.exe

description	pid	process	target process
PID 3308 set thread context of 4164	3308	OrderList.exe	OrderList.exe

pid	process
4612	schtasks.exe

pid	process
3308	OrderList.exe
3308	OrderList.exe
3308	OrderList.exe

description	pid	process
Token: SeDebugPrivilege	3308	OrderList.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

OrderList.exe

description	pid	process	target process
PID 3308 wrote to memory of 4612	3308	OrderList.exe	schtasks.exe
PID 3308 wrote to memory of 4612	3308	OrderList.exe	schtasks.exe
PID 3308 wrote to memory of 4612	3308	OrderList.exe	schtasks.exe
PID 3308 wrote to memory of 4164	3308	OrderList.exe	OrderList.exe
PID 3308 wrote to memory of 4164	3308	OrderList.exe	OrderList.exe
PID 3308 wrote to memory of 4164	3308	OrderList.exe	OrderList.exe
PID 3308 wrote to memory of 4164	3308	OrderList.exe	OrderList.exe
PID 3308 wrote to memory of 4164	3308	OrderList.exe	OrderList.exe
PID 3308 wrote to memory of 4164	3308	OrderList.exe	OrderList.exe
PID 3308 wrote to memory of 4164	3308	OrderList.exe	OrderList.exe
PID 3308 wrote to memory of 4164	3308	OrderList.exe	OrderList.exe
PID 3308 wrote to memory of 4164	3308	OrderList.exe	OrderList.exe
PID 3308 wrote to memory of 4164	3308	OrderList.exe	OrderList.exe
PID 3308 wrote to memory of 4164	3308	OrderList.exe	OrderList.exe

C:\Users\Admin\AppData\Local\Temp\OrderList.exe
"C:\Users\Admin\AppData\Local\Temp\OrderList.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3308

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDD7F.tmp"
2⤵
- Creates scheduled task(s)
PID:4612

C:\Users\Admin\AppData\Local\Temp\OrderList.exe
"{path}"
2⤵
PID:4164

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpDD7F.tmp
Filesize
1KB

MD5
072541fbcc0f05e7e00afb8876087822

SHA1
0a1a6ad25a4a546520fe21bed23b4dd56f5ea7f5

SHA256
8a98b2e2084e096028123a79228bc1b11f12179aecfbe53759b3e0805f973116

SHA512
07074f512ee920a787af3d49d982795121051cc5cd1ce01d115aab63cd800fd58f2f57e73dafb96151e57ada9d2e407e370abc9c56d8ab604d118dad93c1412d

Download Submit
memory/3308-130-0x00000000752D0000-0x0000000075881000-memory.dmp

Filesize
5.7MB

Download
memory/4164-133-0x0000000000000000-mapping.dmp

Download
memory/4164-134-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4164-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4164-137-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4612-131-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads