netwire | a16c2ce4087427f7ea26a1100bebb47a9d5cc46cb9490a1213a29f904d7e62a5

General

Target

IMG SCAN COPY PO ORDER.exe
Size

1.1MB
MD5

d939a9aa374ef97b17cbaa102ddab108
SHA1

4ee65b0f46ef7b369589544faa212cbd790298b9
SHA256

1ac8944d42d3a594940bbd74613193bc47430b6c6c958caf9a5b4521bd9efb91
SHA512

f0557cc439f35dadbae662fe5295acdccfa481899c44cd50bd0f3f3fae4d39e4a7aa2f7ae42c91f1541d22fc4e87a1fffac7051cc84fb1ae568715a63cf2eaf1

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

twohoes.duckdns.org:1710

Attributes

activex_autorun
false
activex_key
copy_executable
false
delete_original
false
host_id
Turkey
install_path
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
offline_keylogger
true
password
Master45
registry_autorun
false
startup_name
use_mutex
false

Signatures

NetWire RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1564-63-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1564-64-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1564-65-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1564-67-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1564-68-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1564-69-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1564-72-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1564-73-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

IMG SCAN COPY PO ORDER.exe

description pid process target process

PID 2016 set thread context of 1564 2016 IMG SCAN COPY PO ORDER.exe IMG SCAN COPY PO ORDER.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1288 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

IMG SCAN COPY PO ORDER.exe

pid process

2016 IMG SCAN COPY PO ORDER.exe
2016 IMG SCAN COPY PO ORDER.exe
2016 IMG SCAN COPY PO ORDER.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

IMG SCAN COPY PO ORDER.exe

description pid process

Token: SeDebugPrivilege 2016 IMG SCAN COPY PO ORDER.exe

description	pid	process	target process
PID 2016 set thread context of 1564	2016	IMG SCAN COPY PO ORDER.exe	IMG SCAN COPY PO ORDER.exe

pid	process
1288	schtasks.exe

pid	process
2016	IMG SCAN COPY PO ORDER.exe
2016	IMG SCAN COPY PO ORDER.exe
2016	IMG SCAN COPY PO ORDER.exe

description	pid	process
Token: SeDebugPrivilege	2016	IMG SCAN COPY PO ORDER.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

IMG SCAN COPY PO ORDER.exe

description	pid	process	target process
PID 2016 wrote to memory of 1288	2016	IMG SCAN COPY PO ORDER.exe	schtasks.exe
PID 2016 wrote to memory of 1288	2016	IMG SCAN COPY PO ORDER.exe	schtasks.exe
PID 2016 wrote to memory of 1288	2016	IMG SCAN COPY PO ORDER.exe	schtasks.exe
PID 2016 wrote to memory of 1288	2016	IMG SCAN COPY PO ORDER.exe	schtasks.exe
PID 2016 wrote to memory of 1564	2016	IMG SCAN COPY PO ORDER.exe	IMG SCAN COPY PO ORDER.exe
PID 2016 wrote to memory of 1564	2016	IMG SCAN COPY PO ORDER.exe	IMG SCAN COPY PO ORDER.exe
PID 2016 wrote to memory of 1564	2016	IMG SCAN COPY PO ORDER.exe	IMG SCAN COPY PO ORDER.exe
PID 2016 wrote to memory of 1564	2016	IMG SCAN COPY PO ORDER.exe	IMG SCAN COPY PO ORDER.exe
PID 2016 wrote to memory of 1564	2016	IMG SCAN COPY PO ORDER.exe	IMG SCAN COPY PO ORDER.exe
PID 2016 wrote to memory of 1564	2016	IMG SCAN COPY PO ORDER.exe	IMG SCAN COPY PO ORDER.exe
PID 2016 wrote to memory of 1564	2016	IMG SCAN COPY PO ORDER.exe	IMG SCAN COPY PO ORDER.exe
PID 2016 wrote to memory of 1564	2016	IMG SCAN COPY PO ORDER.exe	IMG SCAN COPY PO ORDER.exe
PID 2016 wrote to memory of 1564	2016	IMG SCAN COPY PO ORDER.exe	IMG SCAN COPY PO ORDER.exe
PID 2016 wrote to memory of 1564	2016	IMG SCAN COPY PO ORDER.exe	IMG SCAN COPY PO ORDER.exe
PID 2016 wrote to memory of 1564	2016	IMG SCAN COPY PO ORDER.exe	IMG SCAN COPY PO ORDER.exe
PID 2016 wrote to memory of 1564	2016	IMG SCAN COPY PO ORDER.exe	IMG SCAN COPY PO ORDER.exe

C:\Users\Admin\AppData\Local\Temp\IMG SCAN COPY PO ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\IMG SCAN COPY PO ORDER.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kdueTOdtIFAKrD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4339.tmp"
2⤵
- Creates scheduled task(s)
PID:1288

C:\Users\Admin\AppData\Local\Temp\IMG SCAN COPY PO ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\IMG SCAN COPY PO ORDER.exe"
2⤵
PID:1564

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4339.tmp
Filesize
1KB

MD5
07f51b292a0bd89e7f9d7e6253c697d9

SHA1
0cd50e5d2e68f22fda684051ba9e1a77ab455ccb

SHA256
e65552642cefba6b9ff3bc7fe0b307de7f9349dd6a251ca0540b24cd1f39ac02

SHA512
9055980662317f82e368ac17bbb3591bee572ec4f9b4a16e4ef42c53de9f1e538e8a55cef5fbe850a13644873fb4f1412bc51741c053c4fb0c58e589ddaeb6e4

Download Submit
memory/1288-56-0x0000000000000000-mapping.dmp

Download
memory/1564-61-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1564-58-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1564-59-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1564-63-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1564-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1564-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1564-67-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1564-68-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1564-69-0x000000000040242D-mapping.dmp

Download
memory/1564-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1564-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2016-55-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download
memory/2016-54-0x0000000075191000-0x0000000075193000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads