netwire | 3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540

General

Target

3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe
Size

1.8MB
MD5

def190718ee77f76ba654dcda072cac4
SHA1

25bd8c0996413d5e25605c355f734cefbf634cfc
SHA256

3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540
SHA512

6aacc4ec3d0a40486f2df1ec384b705e5115138e62ddad03565e9402c54c4ced3cb16f2fd503d173ba2b101f813d8269bbf2da6d1d7dba4cdaf74a006f52567c

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

ml.warzonedns.com:4772

194.5.98.183:4772

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
fvbrHCbc
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1880-57-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/1880-65-0x0000000000402BCB-mapping.dmp	netwire
behavioral1/memory/1880-68-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/1140-84-0x0000000000402BCB-mapping.dmp	netwire
behavioral1/memory/1680-102-0x0000000000402BCB-mapping.dmp	netwire
behavioral1/memory/1616-120-0x0000000000402BCB-mapping.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 3 IoCs

Processes:

cacls.execacls.execacls.exe

pid process

1936 cacls.exe
1708 cacls.exe
988 cacls.exe

pid	process
1936	cacls.exe
1708	cacls.exe
988	cacls.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe	autoit_exe
C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe	autoit_exe
C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe	autoit_exe
C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe	autoit_exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.execacls.execacls.execacls.exe

description	pid	process	target process
PID 1688 set thread context of 1880	1688	3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe	svchost.exe
PID 1936 set thread context of 1140	1936	cacls.exe	svchost.exe
PID 1708 set thread context of 1680	1708	cacls.exe	svchost.exe
PID 988 set thread context of 1616	988	cacls.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

1924 schtasks.exe
1116 schtasks.exe
740 schtasks.exe
1892 schtasks.exe

pid	process
1924	schtasks.exe
1116	schtasks.exe
740	schtasks.exe
1892	schtasks.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exetaskeng.execacls.execacls.execacls.exe

description	pid	process	target process
PID 1688 wrote to memory of 1880	1688	3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe	svchost.exe
PID 1688 wrote to memory of 1880	1688	3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe	svchost.exe
PID 1688 wrote to memory of 1880	1688	3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe	svchost.exe
PID 1688 wrote to memory of 1880	1688	3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe	svchost.exe
PID 1688 wrote to memory of 1880	1688	3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe	svchost.exe
PID 1688 wrote to memory of 1880	1688	3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe	svchost.exe
PID 1688 wrote to memory of 1892	1688	3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe	schtasks.exe
PID 1688 wrote to memory of 1892	1688	3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe	schtasks.exe
PID 1688 wrote to memory of 1892	1688	3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe	schtasks.exe
PID 1688 wrote to memory of 1892	1688	3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe	schtasks.exe
PID 1864 wrote to memory of 1936	1864	taskeng.exe	cacls.exe
PID 1864 wrote to memory of 1936	1864	taskeng.exe	cacls.exe
PID 1864 wrote to memory of 1936	1864	taskeng.exe	cacls.exe
PID 1864 wrote to memory of 1936	1864	taskeng.exe	cacls.exe
PID 1936 wrote to memory of 1140	1936	cacls.exe	svchost.exe
PID 1936 wrote to memory of 1140	1936	cacls.exe	svchost.exe
PID 1936 wrote to memory of 1140	1936	cacls.exe	svchost.exe
PID 1936 wrote to memory of 1140	1936	cacls.exe	svchost.exe
PID 1936 wrote to memory of 1140	1936	cacls.exe	svchost.exe
PID 1936 wrote to memory of 1140	1936	cacls.exe	svchost.exe
PID 1936 wrote to memory of 1924	1936	cacls.exe	schtasks.exe
PID 1936 wrote to memory of 1924	1936	cacls.exe	schtasks.exe
PID 1936 wrote to memory of 1924	1936	cacls.exe	schtasks.exe
PID 1936 wrote to memory of 1924	1936	cacls.exe	schtasks.exe
PID 1864 wrote to memory of 1708	1864	taskeng.exe	cacls.exe
PID 1864 wrote to memory of 1708	1864	taskeng.exe	cacls.exe
PID 1864 wrote to memory of 1708	1864	taskeng.exe	cacls.exe
PID 1864 wrote to memory of 1708	1864	taskeng.exe	cacls.exe
PID 1708 wrote to memory of 1680	1708	cacls.exe	svchost.exe
PID 1708 wrote to memory of 1680	1708	cacls.exe	svchost.exe
PID 1708 wrote to memory of 1680	1708	cacls.exe	svchost.exe
PID 1708 wrote to memory of 1680	1708	cacls.exe	svchost.exe
PID 1708 wrote to memory of 1680	1708	cacls.exe	svchost.exe
PID 1708 wrote to memory of 1680	1708	cacls.exe	svchost.exe
PID 1708 wrote to memory of 1116	1708	cacls.exe	schtasks.exe
PID 1708 wrote to memory of 1116	1708	cacls.exe	schtasks.exe
PID 1708 wrote to memory of 1116	1708	cacls.exe	schtasks.exe
PID 1708 wrote to memory of 1116	1708	cacls.exe	schtasks.exe
PID 1864 wrote to memory of 988	1864	taskeng.exe	cacls.exe
PID 1864 wrote to memory of 988	1864	taskeng.exe	cacls.exe
PID 1864 wrote to memory of 988	1864	taskeng.exe	cacls.exe
PID 1864 wrote to memory of 988	1864	taskeng.exe	cacls.exe
PID 988 wrote to memory of 1616	988	cacls.exe	svchost.exe
PID 988 wrote to memory of 1616	988	cacls.exe	svchost.exe
PID 988 wrote to memory of 1616	988	cacls.exe	svchost.exe
PID 988 wrote to memory of 1616	988	cacls.exe	svchost.exe
PID 988 wrote to memory of 1616	988	cacls.exe	svchost.exe
PID 988 wrote to memory of 1616	988	cacls.exe	svchost.exe
PID 988 wrote to memory of 740	988	cacls.exe	schtasks.exe
PID 988 wrote to memory of 740	988	cacls.exe	schtasks.exe
PID 988 wrote to memory of 740	988	cacls.exe	schtasks.exe
PID 988 wrote to memory of 740	988	cacls.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe
"C:\Users\Admin\AppData\Local\Temp\3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
2⤵
PID:1880

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn hdwwiz /tr "C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe" /sc minute /mo 1 /F
2⤵
- Creates scheduled task(s)
PID:1892

C:\Windows\system32\taskeng.exe
taskeng.exe {A103082B-F8C2-442C-A78E-A5FF7D88B487} S-1-5-21-790309383-526510583-3802439154-1000:TVHJCWMH\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1864

C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe
C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
3⤵
PID:1140

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn hdwwiz /tr "C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe" /sc minute /mo 1 /F
3⤵
- Creates scheduled task(s)
PID:1924

C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe
C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
3⤵
PID:1680

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn hdwwiz /tr "C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe" /sc minute /mo 1 /F
3⤵
- Creates scheduled task(s)
PID:1116

C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe
C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:988

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
3⤵
PID:1616

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn hdwwiz /tr "C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe" /sc minute /mo 1 /F
3⤵
- Creates scheduled task(s)
PID:740

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe
Filesize
1.8MB

MD5
f19b2dcabfc1d04bf83f84730c924457

SHA1
de224fdec81dcf0a88edcc423877bb44d8af1021

SHA256
6b6f6726eabfd29fe58fd9e9fb2d0c37ef64a4330f4dfcdf21df55787eab9541

SHA512
b1a35ccb7bff862dc55c3d3a69bdae5864a87b135833db8894727b288439f2271beb8d40c306f5314bc6ac8e3ebb6201f93c009ba9ffb38fa1ecc4a92d417e0b

Download Submit
C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe
Filesize
1.8MB

MD5
f19b2dcabfc1d04bf83f84730c924457

SHA1
de224fdec81dcf0a88edcc423877bb44d8af1021

SHA256
6b6f6726eabfd29fe58fd9e9fb2d0c37ef64a4330f4dfcdf21df55787eab9541

SHA512
b1a35ccb7bff862dc55c3d3a69bdae5864a87b135833db8894727b288439f2271beb8d40c306f5314bc6ac8e3ebb6201f93c009ba9ffb38fa1ecc4a92d417e0b

Download Submit
C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe
Filesize
1.8MB

MD5
f19b2dcabfc1d04bf83f84730c924457

SHA1
de224fdec81dcf0a88edcc423877bb44d8af1021

SHA256
6b6f6726eabfd29fe58fd9e9fb2d0c37ef64a4330f4dfcdf21df55787eab9541

SHA512
b1a35ccb7bff862dc55c3d3a69bdae5864a87b135833db8894727b288439f2271beb8d40c306f5314bc6ac8e3ebb6201f93c009ba9ffb38fa1ecc4a92d417e0b

Download Submit
C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe
Filesize
1.8MB

MD5
f19b2dcabfc1d04bf83f84730c924457

SHA1
de224fdec81dcf0a88edcc423877bb44d8af1021

SHA256
6b6f6726eabfd29fe58fd9e9fb2d0c37ef64a4330f4dfcdf21df55787eab9541

SHA512
b1a35ccb7bff862dc55c3d3a69bdae5864a87b135833db8894727b288439f2271beb8d40c306f5314bc6ac8e3ebb6201f93c009ba9ffb38fa1ecc4a92d417e0b

Download Submit
memory/740-124-0x0000000000000000-mapping.dmp

Download
memory/988-107-0x0000000000000000-mapping.dmp

Download
memory/1116-106-0x0000000000000000-mapping.dmp

Download
memory/1140-84-0x0000000000402BCB-mapping.dmp

Download
memory/1616-120-0x0000000000402BCB-mapping.dmp

Download
memory/1680-102-0x0000000000402BCB-mapping.dmp

Download
memory/1688-54-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/1708-89-0x0000000000000000-mapping.dmp

Download
memory/1880-68-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1880-57-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1880-65-0x0000000000402BCB-mapping.dmp

Download
memory/1880-55-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1892-69-0x0000000000000000-mapping.dmp

Download
memory/1924-88-0x0000000000000000-mapping.dmp

Download
memory/1936-71-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads