netwire | 5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f

General

Target

5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe
Size

273KB
MD5

454dba160165cb2fa663e44af54dd26d
SHA1

fa02dddeb360e4bd750b1b0893a59f39e742938b
SHA256

5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f
SHA512

6dd812f73e897755490cf6fe18f6857fe6326916072612434fa7d25e3c12454dac9a8545247281eb20613e845a868f8ea99a13fdf8297f1665b800bf80abe859

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

zied2020.duckdns.org:3360

45.95.168.129:3360

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
winners
install_path
%AppData%\Install\javaw.exe
keylogger_dir
%AppData%\Logs\
lock_executable
true
offline_keylogger
true
password
Password
registry_autorun
true
startup_name
javaw
use_mutex
false

Signatures

NetWire RAT payload 10 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1768-63-0x0000000000400000-0x0000000000430000-memory.dmp	netwire
behavioral1/memory/1768-62-0x0000000000400000-0x0000000000430000-memory.dmp	netwire
behavioral1/memory/1768-66-0x0000000000400000-0x0000000000430000-memory.dmp	netwire
behavioral1/memory/1768-65-0x0000000000400000-0x0000000000430000-memory.dmp	netwire
behavioral1/memory/1768-67-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1768-70-0x0000000000400000-0x0000000000430000-memory.dmp	netwire
behavioral1/memory/1768-74-0x0000000000400000-0x0000000000430000-memory.dmp	netwire
behavioral1/memory/692-88-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/692-93-0x0000000000080000-0x00000000000B0000-memory.dmp	netwire
behavioral1/memory/692-98-0x0000000000080000-0x00000000000B0000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

javaw.exejavaw.exe

pid process

2044 javaw.exe
692 javaw.exe
Loads dropped DLL 2 IoCs

Processes:

5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exejavaw.exe

pid process

1768 5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe
2044 javaw.exe

pid	process
2044	javaw.exe
692	javaw.exe

pid	process
1768	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe
2044	javaw.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

javaw.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	javaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\javaw = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\javaw.exe"	javaw.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exejavaw.exe

description	pid	process	target process
PID 1096 set thread context of 1768	1096	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe
PID 2044 set thread context of 692	2044	javaw.exe	javaw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exejavaw.exe

description	pid	process
Token: SeDebugPrivilege	1096	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe
Token: SeDebugPrivilege	2044	javaw.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exejavaw.exe

description	pid	process	target process
PID 1096 wrote to memory of 1768	1096	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe
PID 1096 wrote to memory of 1768	1096	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe
PID 1096 wrote to memory of 1768	1096	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe
PID 1096 wrote to memory of 1768	1096	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe
PID 1096 wrote to memory of 1768	1096	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe
PID 1096 wrote to memory of 1768	1096	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe
PID 1096 wrote to memory of 1768	1096	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe
PID 1096 wrote to memory of 1768	1096	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe
PID 1096 wrote to memory of 1768	1096	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe
PID 1096 wrote to memory of 1768	1096	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe
PID 1096 wrote to memory of 1768	1096	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe
PID 1768 wrote to memory of 2044	1768	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe	javaw.exe
PID 1768 wrote to memory of 2044	1768	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe	javaw.exe
PID 1768 wrote to memory of 2044	1768	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe	javaw.exe
PID 1768 wrote to memory of 2044	1768	5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe	javaw.exe
PID 2044 wrote to memory of 692	2044	javaw.exe	javaw.exe
PID 2044 wrote to memory of 692	2044	javaw.exe	javaw.exe
PID 2044 wrote to memory of 692	2044	javaw.exe	javaw.exe
PID 2044 wrote to memory of 692	2044	javaw.exe	javaw.exe
PID 2044 wrote to memory of 692	2044	javaw.exe	javaw.exe
PID 2044 wrote to memory of 692	2044	javaw.exe	javaw.exe
PID 2044 wrote to memory of 692	2044	javaw.exe	javaw.exe
PID 2044 wrote to memory of 692	2044	javaw.exe	javaw.exe
PID 2044 wrote to memory of 692	2044	javaw.exe	javaw.exe
PID 2044 wrote to memory of 692	2044	javaw.exe	javaw.exe
PID 2044 wrote to memory of 692	2044	javaw.exe	javaw.exe

C:\Users\Admin\AppData\Local\Temp\5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe
"C:\Users\Admin\AppData\Local\Temp\5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096

C:\Users\Admin\AppData\Local\Temp\5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe
"C:\Users\Admin\AppData\Local\Temp\5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1768

C:\Users\Admin\AppData\Roaming\Install\javaw.exe
"C:\Users\Admin\AppData\Roaming\Install\javaw.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044

C:\Users\Admin\AppData\Roaming\Install\javaw.exe
"C:\Users\Admin\AppData\Roaming\Install\javaw.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\javaw.exe

Filesize
273KB

MD5
454dba160165cb2fa663e44af54dd26d

SHA1
fa02dddeb360e4bd750b1b0893a59f39e742938b

SHA256
5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f

SHA512
6dd812f73e897755490cf6fe18f6857fe6326916072612434fa7d25e3c12454dac9a8545247281eb20613e845a868f8ea99a13fdf8297f1665b800bf80abe859

Download Submit
C:\Users\Admin\AppData\Roaming\Install\javaw.exe

Filesize
273KB

MD5
454dba160165cb2fa663e44af54dd26d

SHA1
fa02dddeb360e4bd750b1b0893a59f39e742938b

SHA256
5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f

SHA512
6dd812f73e897755490cf6fe18f6857fe6326916072612434fa7d25e3c12454dac9a8545247281eb20613e845a868f8ea99a13fdf8297f1665b800bf80abe859

Download Submit
C:\Users\Admin\AppData\Roaming\Install\javaw.exe

Filesize
273KB

MD5
454dba160165cb2fa663e44af54dd26d

SHA1
fa02dddeb360e4bd750b1b0893a59f39e742938b

SHA256
5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f

SHA512
6dd812f73e897755490cf6fe18f6857fe6326916072612434fa7d25e3c12454dac9a8545247281eb20613e845a868f8ea99a13fdf8297f1665b800bf80abe859

Download Submit
\Users\Admin\AppData\Roaming\Install\javaw.exe

Filesize
273KB

MD5
454dba160165cb2fa663e44af54dd26d

SHA1
fa02dddeb360e4bd750b1b0893a59f39e742938b

SHA256
5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f

SHA512
6dd812f73e897755490cf6fe18f6857fe6326916072612434fa7d25e3c12454dac9a8545247281eb20613e845a868f8ea99a13fdf8297f1665b800bf80abe859

Download Submit
\Users\Admin\AppData\Roaming\Install\javaw.exe

Filesize
273KB

MD5
454dba160165cb2fa663e44af54dd26d

SHA1
fa02dddeb360e4bd750b1b0893a59f39e742938b

SHA256
5f4254d96d437929fc381b7a86c01304d02d17e9b7cd1e8195544ab16c69369f

SHA512
6dd812f73e897755490cf6fe18f6857fe6326916072612434fa7d25e3c12454dac9a8545247281eb20613e845a868f8ea99a13fdf8297f1665b800bf80abe859

Download Submit
memory/692-98-0x0000000000080000-0x00000000000B0000-memory.dmp

Filesize
192KB

Download
memory/692-93-0x0000000000080000-0x00000000000B0000-memory.dmp

Filesize
192KB

Download
memory/692-88-0x000000000040242D-mapping.dmp

Download
memory/1096-54-0x0000000000200000-0x000000000024C000-memory.dmp

Filesize
304KB

Download
memory/1096-55-0x00000000005A0000-0x00000000005CC000-memory.dmp

Filesize
176KB

Download
memory/1096-56-0x00000000002E0000-0x00000000002E8000-memory.dmp

Filesize
32KB

Download
memory/1768-70-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1768-69-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1768-67-0x000000000040242D-mapping.dmp

Download
memory/1768-65-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1768-74-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1768-66-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1768-62-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1768-63-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1768-58-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1768-60-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1768-57-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2044-72-0x0000000000000000-mapping.dmp

Download
memory/2044-76-0x0000000000140000-0x000000000018C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads