netwire | 3f3e54ed38565062b4d46d9ef8f1fa06c34cdf9ecf998ee6ec8d9b95160547ed

General

Target

FADEX_16.exe
Size

291KB
MD5

33a4cfe431ca51de83e78a58a0ba4631
SHA1

ce870eae750f10ec50dcfba2850ba3e0b7d50be8
SHA256

f24e45d41404cdbd5b3e88ef39f6b047d062ade5cb3bddbe2ad40d5331e27210
SHA512

fb1569a7bdc839875024c8cf29d41f8166b346b3b512a806e6f40af697a3c3cb95526caabf1431ad22fcbe284bde177cd837a87db1decce87cb1316cf9f044a3

Score

10^/10

netwire botnet rat rezer0 stealer

Malware Config

Extracted

Family

netwire

C2

winx.xcapdatap.capetown:7390

Attributes

activex_autorun
false
activex_key
copy_executable
false
delete_original
false
host_id
Jagz_$$$
install_path
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
offline_keylogger
true
password
P@55w0rd!
registry_autorun
false
startup_name
use_mutex
false

Signatures

NetWire RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1188-65-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1188-66-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1188-67-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1188-69-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1188-70-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1188-71-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1188-74-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1188-75-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/1956-56-0x00000000004B0000-0x00000000004E6000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

Processes:

FADEX_16.exe

description pid process target process

PID 1956 set thread context of 1188 1956 FADEX_16.exe FADEX_16.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1736 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

FADEX_16.exe

pid process

1956 FADEX_16.exe
1956 FADEX_16.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

FADEX_16.exe

description pid process

Token: SeDebugPrivilege 1956 FADEX_16.exe

description	pid	process	target process
PID 1956 set thread context of 1188	1956	FADEX_16.exe	FADEX_16.exe

pid	process
1736	schtasks.exe

pid	process
1956	FADEX_16.exe
1956	FADEX_16.exe

description	pid	process
Token: SeDebugPrivilege	1956	FADEX_16.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

FADEX_16.exe

description	pid	process	target process
PID 1956 wrote to memory of 1736	1956	FADEX_16.exe	schtasks.exe
PID 1956 wrote to memory of 1736	1956	FADEX_16.exe	schtasks.exe
PID 1956 wrote to memory of 1736	1956	FADEX_16.exe	schtasks.exe
PID 1956 wrote to memory of 1736	1956	FADEX_16.exe	schtasks.exe
PID 1956 wrote to memory of 1740	1956	FADEX_16.exe	FADEX_16.exe
PID 1956 wrote to memory of 1740	1956	FADEX_16.exe	FADEX_16.exe
PID 1956 wrote to memory of 1740	1956	FADEX_16.exe	FADEX_16.exe
PID 1956 wrote to memory of 1740	1956	FADEX_16.exe	FADEX_16.exe
PID 1956 wrote to memory of 1220	1956	FADEX_16.exe	FADEX_16.exe
PID 1956 wrote to memory of 1220	1956	FADEX_16.exe	FADEX_16.exe
PID 1956 wrote to memory of 1220	1956	FADEX_16.exe	FADEX_16.exe
PID 1956 wrote to memory of 1220	1956	FADEX_16.exe	FADEX_16.exe
PID 1956 wrote to memory of 1188	1956	FADEX_16.exe	FADEX_16.exe
PID 1956 wrote to memory of 1188	1956	FADEX_16.exe	FADEX_16.exe
PID 1956 wrote to memory of 1188	1956	FADEX_16.exe	FADEX_16.exe
PID 1956 wrote to memory of 1188	1956	FADEX_16.exe	FADEX_16.exe
PID 1956 wrote to memory of 1188	1956	FADEX_16.exe	FADEX_16.exe
PID 1956 wrote to memory of 1188	1956	FADEX_16.exe	FADEX_16.exe
PID 1956 wrote to memory of 1188	1956	FADEX_16.exe	FADEX_16.exe
PID 1956 wrote to memory of 1188	1956	FADEX_16.exe	FADEX_16.exe
PID 1956 wrote to memory of 1188	1956	FADEX_16.exe	FADEX_16.exe
PID 1956 wrote to memory of 1188	1956	FADEX_16.exe	FADEX_16.exe
PID 1956 wrote to memory of 1188	1956	FADEX_16.exe	FADEX_16.exe
PID 1956 wrote to memory of 1188	1956	FADEX_16.exe	FADEX_16.exe

C:\Users\Admin\AppData\Local\Temp\FADEX_16.exe
"C:\Users\Admin\AppData\Local\Temp\FADEX_16.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BElCbvvZQg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2AAA.tmp"
2⤵
- Creates scheduled task(s)
PID:1736

C:\Users\Admin\AppData\Local\Temp\FADEX_16.exe
"{path}"
2⤵
PID:1740

C:\Users\Admin\AppData\Local\Temp\FADEX_16.exe
"{path}"
2⤵
PID:1220

C:\Users\Admin\AppData\Local\Temp\FADEX_16.exe
"{path}"
2⤵
PID:1188

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2AAA.tmp
Filesize
1KB

MD5
61cd71051c88909cb200c5b09cd4d799

SHA1
9eced5c6282e85525c6c514f1ad08ac6e6de27ad

SHA256
4fdc1b7eed031eec27f3268c2b61407d5be9de76dbd1b2c535ade8a429867a78

SHA512
168495815c5b5b8029ac667564c8a4fcc9139751995b31c169a7e7f783c0567bc47e771a574ca531b4451cbe150f85f5e553f2bd929789994abca7b27818dcec

Download Submit
memory/1188-69-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1188-61-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1188-75-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1188-74-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1188-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1188-60-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1188-71-0x000000000040242D-mapping.dmp

Download
memory/1188-63-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1188-70-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1188-66-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1188-67-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1736-58-0x0000000000000000-mapping.dmp

Download
memory/1956-54-0x0000000000940000-0x000000000098E000-memory.dmp

Filesize
312KB

Download
memory/1956-55-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1956-56-0x00000000004B0000-0x00000000004E6000-memory.dmp

Filesize
216KB

Download
memory/1956-57-0x0000000075DB1000-0x0000000075DB3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads