netwire | 461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51

General

Target

461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51.exe
Size

696KB
MD5

399875e9d324075be8e0bdc9c40db26f
SHA1

9444dbe54f9965a47c754853a28ad5ef1ee542ae
SHA256

461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51
SHA512

68f202fba09a43a7b7eebb15e98933a6a26e530683cd158ef8be78b5ad15e6874da9d3963582631746b9b31cfed19c9047bc5267c57018d0a1494bf5f46df4c7

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1508-83-0x0000000000400000-0x00000000004AE000-memory.dmp	netwire
behavioral1/memory/1508-84-0x0000000000400000-0x000000000042B000-memory.dmp	netwire
behavioral1/memory/1508-91-0x0000000000400000-0x00000000004AE000-memory.dmp	netwire
behavioral1/memory/1508-93-0x0000000000400000-0x00000000004AE000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

bcvdfgsd.exebcvdfgsd.exe

pid process

1232 bcvdfgsd.exe
1508 bcvdfgsd.exe

pid	process
1232	bcvdfgsd.exe
1508	bcvdfgsd.exe

Loads dropped DLL 2 IoCs

Processes:

461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51.exe

pid	process
1744	461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51.exe
1744	461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WScript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Net Host = "C:\\Users\\Admin\\vbnfghcbv\\bcvdfgsd.vbs -BN"	WScript.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51.exebcvdfgsd.exebcvdfgsd.exe

pid process

1744 461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51.exe
1232 bcvdfgsd.exe
1508 bcvdfgsd.exe
1508 bcvdfgsd.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

bcvdfgsd.exe

description pid process target process

PID 1232 set thread context of 1508 1232 bcvdfgsd.exe bcvdfgsd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51.exebcvdfgsd.exe

pid process

1744 461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51.exe
1232 bcvdfgsd.exe

description	pid	process	target process
PID 1232 set thread context of 1508	1232	bcvdfgsd.exe	bcvdfgsd.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51.exebcvdfgsd.exe

description	pid	process	target process
PID 1744 wrote to memory of 2040	1744	461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51.exe	WScript.exe
PID 1744 wrote to memory of 2040	1744	461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51.exe	WScript.exe
PID 1744 wrote to memory of 2040	1744	461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51.exe	WScript.exe
PID 1744 wrote to memory of 2040	1744	461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51.exe	WScript.exe
PID 1744 wrote to memory of 1232	1744	461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51.exe	bcvdfgsd.exe
PID 1744 wrote to memory of 1232	1744	461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51.exe	bcvdfgsd.exe
PID 1744 wrote to memory of 1232	1744	461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51.exe	bcvdfgsd.exe
PID 1744 wrote to memory of 1232	1744	461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51.exe	bcvdfgsd.exe
PID 1232 wrote to memory of 1508	1232	bcvdfgsd.exe	bcvdfgsd.exe
PID 1232 wrote to memory of 1508	1232	bcvdfgsd.exe	bcvdfgsd.exe
PID 1232 wrote to memory of 1508	1232	bcvdfgsd.exe	bcvdfgsd.exe
PID 1232 wrote to memory of 1508	1232	bcvdfgsd.exe	bcvdfgsd.exe

C:\Users\Admin\AppData\Local\Temp\461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51.exe
"C:\Users\Admin\AppData\Local\Temp\461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\vbnfghcbv\bcvdfgsd.vbs"
2⤵
- Adds Run key to start application
PID:2040

C:\Users\Admin\vbnfghcbv\bcvdfgsd.exe
"C:\Users\Admin\vbnfghcbv\bcvdfgsd.exe"
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232

C:\Users\Admin\vbnfghcbv\bcvdfgsd.exe
"C:\Users\Admin\vbnfghcbv\bcvdfgsd.exe"
3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\vbnfghcbv\bcvdfgsd.exe

Filesize
696KB

MD5
399875e9d324075be8e0bdc9c40db26f

SHA1
9444dbe54f9965a47c754853a28ad5ef1ee542ae

SHA256
461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51

SHA512
68f202fba09a43a7b7eebb15e98933a6a26e530683cd158ef8be78b5ad15e6874da9d3963582631746b9b31cfed19c9047bc5267c57018d0a1494bf5f46df4c7

Download Submit
C:\Users\Admin\vbnfghcbv\bcvdfgsd.exe

Filesize
696KB

MD5
399875e9d324075be8e0bdc9c40db26f

SHA1
9444dbe54f9965a47c754853a28ad5ef1ee542ae

SHA256
461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51

SHA512
68f202fba09a43a7b7eebb15e98933a6a26e530683cd158ef8be78b5ad15e6874da9d3963582631746b9b31cfed19c9047bc5267c57018d0a1494bf5f46df4c7

Download Submit
C:\Users\Admin\vbnfghcbv\bcvdfgsd.exe

Filesize
696KB

MD5
399875e9d324075be8e0bdc9c40db26f

SHA1
9444dbe54f9965a47c754853a28ad5ef1ee542ae

SHA256
461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51

SHA512
68f202fba09a43a7b7eebb15e98933a6a26e530683cd158ef8be78b5ad15e6874da9d3963582631746b9b31cfed19c9047bc5267c57018d0a1494bf5f46df4c7

Download Submit
C:\Users\Admin\vbnfghcbv\bcvdfgsd.vbs

Filesize
1020B

MD5
21cf2e4768afcc318693cbde9a511ab6

SHA1
f0ca1f2c3291f0135928b9268050ed3b9268eb8f

SHA256
bdd3f2b154f552e55ad74650f1801d5c26abe8916803580021cc193d590f1f4d

SHA512
cd5aef4c3220701d4ca6f37cababf3ade051cbf6331183c32aa98a399207144974e30474e3b0bf6ed079fbb1302d771ae943b6f6e1b74ca2f327e473288712a4

Download Submit
\Users\Admin\vbnfghcbv\bcvdfgsd.exe

Filesize
696KB

MD5
399875e9d324075be8e0bdc9c40db26f

SHA1
9444dbe54f9965a47c754853a28ad5ef1ee542ae

SHA256
461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51

SHA512
68f202fba09a43a7b7eebb15e98933a6a26e530683cd158ef8be78b5ad15e6874da9d3963582631746b9b31cfed19c9047bc5267c57018d0a1494bf5f46df4c7

Download Submit
\Users\Admin\vbnfghcbv\bcvdfgsd.exe

Filesize
696KB

MD5
399875e9d324075be8e0bdc9c40db26f

SHA1
9444dbe54f9965a47c754853a28ad5ef1ee542ae

SHA256
461db0bd78da3f5740d355ab5bb72b78411d1d2321bf78101e75dd34fc301b51

SHA512
68f202fba09a43a7b7eebb15e98933a6a26e530683cd158ef8be78b5ad15e6874da9d3963582631746b9b31cfed19c9047bc5267c57018d0a1494bf5f46df4c7

Download Submit
memory/1232-75-0x0000000077570000-0x0000000077719000-memory.dmp

Filesize
1.7MB

Download
memory/1232-80-0x0000000077750000-0x00000000778D0000-memory.dmp

Filesize
1.5MB

Download
memory/1232-65-0x0000000000000000-mapping.dmp

Download
memory/1232-79-0x00000000002F0000-0x00000000002FE000-memory.dmp

Filesize
56KB

Download
memory/1508-84-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1508-83-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1508-93-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1508-92-0x0000000000220000-0x000000000022E000-memory.dmp

Filesize
56KB

Download
memory/1508-91-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1508-77-0x000000000041385B-mapping.dmp

Download
memory/1508-90-0x0000000077570000-0x0000000077719000-memory.dmp

Filesize
1.7MB

Download
memory/1744-56-0x0000000000280000-0x000000000028E000-memory.dmp

Filesize
56KB

Download
memory/1744-57-0x0000000076451000-0x0000000076453000-memory.dmp

Filesize
8KB

Download
memory/1744-59-0x0000000077750000-0x00000000778D0000-memory.dmp

Filesize
1.5MB

Download
memory/1744-61-0x0000000000280000-0x000000000028E000-memory.dmp

Filesize
56KB

Download
memory/1744-58-0x0000000077570000-0x0000000077719000-memory.dmp

Filesize
1.7MB

Download
memory/1744-71-0x0000000077750000-0x00000000778D0000-memory.dmp

Filesize
1.5MB

Download
memory/1744-67-0x0000000000280000-0x000000000028E000-memory.dmp

Filesize
56KB

Download
memory/2040-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads