netwire | 3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540

General

Target

3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe
Size

1.8MB
MD5

def190718ee77f76ba654dcda072cac4
SHA1

25bd8c0996413d5e25605c355f734cefbf634cfc
SHA256

3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540
SHA512

6aacc4ec3d0a40486f2df1ec384b705e5115138e62ddad03565e9402c54c4ced3cb16f2fd503d173ba2b101f813d8269bbf2da6d1d7dba4cdaf74a006f52567c

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

ml.warzonedns.com:4772

194.5.98.183:4772

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
fvbrHCbc
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2884-131-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/2884-140-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

cacls.execacls.exe

pid process

2332 cacls.exe
592 cacls.exe

pid	process
2332	cacls.exe
592	cacls.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.execacls.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	cacls.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe	autoit_exe
C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe	autoit_exe
C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.execacls.execacls.exe

description	pid	process	target process
PID 1600 set thread context of 2884	1600	3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe	svchost.exe
PID 2332 set thread context of 1332	2332	cacls.exe	svchost.exe
PID 592 set thread context of 2560	592	cacls.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1948 schtasks.exe
1092 schtasks.exe

pid	process
1948	schtasks.exe
1092	schtasks.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.execacls.execacls.exe

description	pid	process	target process
PID 1600 wrote to memory of 2884	1600	3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe	svchost.exe
PID 1600 wrote to memory of 2884	1600	3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe	svchost.exe
PID 1600 wrote to memory of 2884	1600	3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe	svchost.exe
PID 1600 wrote to memory of 2884	1600	3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe	svchost.exe
PID 1600 wrote to memory of 2884	1600	3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe	svchost.exe
PID 1600 wrote to memory of 1948	1600	3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe	schtasks.exe
PID 1600 wrote to memory of 1948	1600	3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe	schtasks.exe
PID 1600 wrote to memory of 1948	1600	3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe	schtasks.exe
PID 2332 wrote to memory of 1332	2332	cacls.exe	svchost.exe
PID 2332 wrote to memory of 1332	2332	cacls.exe	svchost.exe
PID 2332 wrote to memory of 1332	2332	cacls.exe	svchost.exe
PID 2332 wrote to memory of 1332	2332	cacls.exe	svchost.exe
PID 2332 wrote to memory of 1332	2332	cacls.exe	svchost.exe
PID 2332 wrote to memory of 1092	2332	cacls.exe	schtasks.exe
PID 2332 wrote to memory of 1092	2332	cacls.exe	schtasks.exe
PID 2332 wrote to memory of 1092	2332	cacls.exe	schtasks.exe
PID 592 wrote to memory of 2560	592	cacls.exe	svchost.exe
PID 592 wrote to memory of 2560	592	cacls.exe	svchost.exe
PID 592 wrote to memory of 2560	592	cacls.exe	svchost.exe
PID 592 wrote to memory of 2560	592	cacls.exe	svchost.exe
PID 592 wrote to memory of 2560	592	cacls.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe
"C:\Users\Admin\AppData\Local\Temp\3e5ab6c919f0a1c87267e6eb64da2bc7ea2e5dc3f8e72aba4f92e036c7932540.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
2⤵
PID:2884

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn hdwwiz /tr "C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe" /sc minute /mo 1 /F
2⤵
- Creates scheduled task(s)
PID:1948

C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe
C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2332

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
2⤵
PID:1332

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn hdwwiz /tr "C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe" /sc minute /mo 1 /F
2⤵
- Creates scheduled task(s)
PID:1092

C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe
C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:592

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
2⤵
PID:2560

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe
Filesize
1.8MB

MD5
cddd444253f51000dad0be27412a159e

SHA1
ec25c88fdfe4c9e86573ae03b91593a01c823b5c

SHA256
83a145f56f3a9ec2557e55be7bd02a85e317f2df50d8365bc42b809ec341d21a

SHA512
16a1c4def33f803ad2f5870189a2cc04094140663b4a6ac9de915438349319ec61767f97a8110cf1a2ec4e68fc480e9ca8e90b4d2d03cc2dd38fd822e9d36efe

Download Submit
C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe
Filesize
1.8MB

MD5
cddd444253f51000dad0be27412a159e

SHA1
ec25c88fdfe4c9e86573ae03b91593a01c823b5c

SHA256
83a145f56f3a9ec2557e55be7bd02a85e317f2df50d8365bc42b809ec341d21a

SHA512
16a1c4def33f803ad2f5870189a2cc04094140663b4a6ac9de915438349319ec61767f97a8110cf1a2ec4e68fc480e9ca8e90b4d2d03cc2dd38fd822e9d36efe

Download Submit
C:\Users\Admin\AppData\Roaming\SystemUWPLauncher\cacls.exe
Filesize
1.8MB

MD5
cddd444253f51000dad0be27412a159e

SHA1
ec25c88fdfe4c9e86573ae03b91593a01c823b5c

SHA256
83a145f56f3a9ec2557e55be7bd02a85e317f2df50d8365bc42b809ec341d21a

SHA512
16a1c4def33f803ad2f5870189a2cc04094140663b4a6ac9de915438349319ec61767f97a8110cf1a2ec4e68fc480e9ca8e90b4d2d03cc2dd38fd822e9d36efe

Download Submit
memory/1092-155-0x0000000000000000-mapping.dmp

Download
memory/1332-144-0x0000000000000000-mapping.dmp

Download
memory/1948-141-0x0000000000000000-mapping.dmp

Download
memory/2560-157-0x0000000000000000-mapping.dmp

Download
memory/2884-130-0x0000000000000000-mapping.dmp

Download
memory/2884-131-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2884-140-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads