netwire | 45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20220414-en
submitted
07-07-2022 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe
Size

128KB
MD5

92e7c6edf4169956af7e5ba92cac3d2a
SHA1

dd3b1533a9423d1939cde54b8a696c8844e50dc6
SHA256

45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d
SHA512

93c0fe3c51a51ca0ee51b1f789caf9abfa5c62a4e4bfcc6664b583cd7b201e0ffba63fcc8873d0af256137742e9f3014b2e20a4363708545e86bb73793d05a92

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1616-62-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1616-64-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1616-65-0x00000000004021DA-mapping.dmp	netwire
behavioral1/memory/1616-68-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1616-72-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1356-88-0x00000000004021DA-mapping.dmp	netwire
behavioral1/memory/1356-93-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1356-94-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

Notepad.exeNotepad.exe

pid process

2044 Notepad.exe
1356 Notepad.exe

pid	process
2044	Notepad.exe
1356	Notepad.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Notepad.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{IGXB136N-WP56-42I3-3EN8-85A00571YU01}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Notepad.exe\""	Notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{IGXB136N-WP56-42I3-3EN8-85A00571YU01}	Notepad.exe

Loads dropped DLL 5 IoCs

Processes:

45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exeNotepad.exe

pid	process
1964	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe
1964	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe
1616	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe
2044	Notepad.exe
2044	Notepad.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Notepad.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Notepad = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Notepad.exe"	Notepad.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exeNotepad.exe

description	pid	process	target process
PID 1964 set thread context of 1616	1964	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe
PID 2044 set thread context of 1356	2044	Notepad.exe	Notepad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 8 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Install\Notepad.exe	nsis_installer_1
\Users\Admin\AppData\Roaming\Install\Notepad.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\Install\Notepad.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\Install\Notepad.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\Install\Notepad.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\Install\Notepad.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\Install\Notepad.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\Install\Notepad.exe	nsis_installer_2

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exeNotepad.exe

description	pid	process	target process
PID 1964 wrote to memory of 1616	1964	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe
PID 1964 wrote to memory of 1616	1964	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe
PID 1964 wrote to memory of 1616	1964	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe
PID 1964 wrote to memory of 1616	1964	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe
PID 1964 wrote to memory of 1616	1964	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe
PID 1964 wrote to memory of 1616	1964	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe
PID 1964 wrote to memory of 1616	1964	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe
PID 1964 wrote to memory of 1616	1964	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe
PID 1964 wrote to memory of 1616	1964	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe
PID 1616 wrote to memory of 2044	1616	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe	Notepad.exe
PID 1616 wrote to memory of 2044	1616	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe	Notepad.exe
PID 1616 wrote to memory of 2044	1616	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe	Notepad.exe
PID 1616 wrote to memory of 2044	1616	45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe	Notepad.exe
PID 2044 wrote to memory of 1356	2044	Notepad.exe	Notepad.exe
PID 2044 wrote to memory of 1356	2044	Notepad.exe	Notepad.exe
PID 2044 wrote to memory of 1356	2044	Notepad.exe	Notepad.exe
PID 2044 wrote to memory of 1356	2044	Notepad.exe	Notepad.exe
PID 2044 wrote to memory of 1356	2044	Notepad.exe	Notepad.exe
PID 2044 wrote to memory of 1356	2044	Notepad.exe	Notepad.exe
PID 2044 wrote to memory of 1356	2044	Notepad.exe	Notepad.exe
PID 2044 wrote to memory of 1356	2044	Notepad.exe	Notepad.exe
PID 2044 wrote to memory of 1356	2044	Notepad.exe	Notepad.exe

C:\Users\Admin\AppData\Local\Temp\45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe
"C:\Users\Admin\AppData\Local\Temp\45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1964

C:\Users\Admin\AppData\Local\Temp\45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe
C:\Users\Admin\AppData\Local\Temp\45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d.exe
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616

C:\Users\Admin\AppData\Roaming\Install\Notepad.exe
"C:\Users\Admin\AppData\Roaming\Install\Notepad.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2044

C:\Users\Admin\AppData\Roaming\Install\Notepad.exe
C:\Users\Admin\AppData\Roaming\Install\Notepad.exe
4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:1356

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HydrogenateWraparound

Filesize
1KB

MD5
f27004352e72181942bcf21dff122183

SHA1
d6de77c2824702401d05934fef3a4a2201984cad

SHA256
bf97ca205c73b47ceb5dd4e0da9bd8a4809ef440c96a0c59f596839acbf8e76a

SHA512
34521dc2b62a9280d9a2d178750cfdc038afee7c0a296cfe664dcdbd8c92217d2b232a0d4ea49f2a50fb0701ae8918575f9d27478e1bbcac5b44d4cc23df84ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\lockers.dll

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\monospace.font.family.xml

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Notepad.exe

Filesize
128KB

MD5
92e7c6edf4169956af7e5ba92cac3d2a

SHA1
dd3b1533a9423d1939cde54b8a696c8844e50dc6

SHA256
45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d

SHA512
93c0fe3c51a51ca0ee51b1f789caf9abfa5c62a4e4bfcc6664b583cd7b201e0ffba63fcc8873d0af256137742e9f3014b2e20a4363708545e86bb73793d05a92

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Notepad.exe

Filesize
128KB

MD5
92e7c6edf4169956af7e5ba92cac3d2a

SHA1
dd3b1533a9423d1939cde54b8a696c8844e50dc6

SHA256
45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d

SHA512
93c0fe3c51a51ca0ee51b1f789caf9abfa5c62a4e4bfcc6664b583cd7b201e0ffba63fcc8873d0af256137742e9f3014b2e20a4363708545e86bb73793d05a92

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Notepad.exe

Filesize
128KB

MD5
92e7c6edf4169956af7e5ba92cac3d2a

SHA1
dd3b1533a9423d1939cde54b8a696c8844e50dc6

SHA256
45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d

SHA512
93c0fe3c51a51ca0ee51b1f789caf9abfa5c62a4e4bfcc6664b583cd7b201e0ffba63fcc8873d0af256137742e9f3014b2e20a4363708545e86bb73793d05a92

Download Submit
\Users\Admin\AppData\Local\Temp\lockers.dll

Filesize
23KB

MD5
0429bfc7b57a563d5cee8f5c17d36af9

SHA1
c860090d5677e883001fe80128a904c1d20c4b3e

SHA256
15d3319581b07cbd900b3699a3200bec63a13a93002dd0700fff4d6f53d0085f

SHA512
ca6e90ac0fd0e3510a5a36b1a64bc7695c7db5e2f7ea1582526ae2cace38e1673dd73365b03e7cd2a1799888f4b0162239e8795b8843923baee2c6fd3a5a10d1

Download Submit
\Users\Admin\AppData\Local\Temp\lockers.dll

Filesize
23KB

MD5
0429bfc7b57a563d5cee8f5c17d36af9

SHA1
c860090d5677e883001fe80128a904c1d20c4b3e

SHA256
15d3319581b07cbd900b3699a3200bec63a13a93002dd0700fff4d6f53d0085f

SHA512
ca6e90ac0fd0e3510a5a36b1a64bc7695c7db5e2f7ea1582526ae2cace38e1673dd73365b03e7cd2a1799888f4b0162239e8795b8843923baee2c6fd3a5a10d1

Download Submit
\Users\Admin\AppData\Local\Temp\nst1D15.tmp\System.dll

Filesize
11KB

MD5
883eff06ac96966270731e4e22817e11

SHA1
523c87c98236cbc04430e87ec19b977595092ac8

SHA256
44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

SHA512
60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

Download Submit
\Users\Admin\AppData\Local\Temp\nst51CB.tmp\System.dll

Filesize
11KB

MD5
883eff06ac96966270731e4e22817e11

SHA1
523c87c98236cbc04430e87ec19b977595092ac8

SHA256
44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

SHA512
60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

Download Submit
\Users\Admin\AppData\Roaming\Install\Notepad.exe

Filesize
128KB

MD5
92e7c6edf4169956af7e5ba92cac3d2a

SHA1
dd3b1533a9423d1939cde54b8a696c8844e50dc6

SHA256
45c12cd295e2ed46b454e8b3b30132ad5454c22232b1a18bc2a2545d5e810a3d

SHA512
93c0fe3c51a51ca0ee51b1f789caf9abfa5c62a4e4bfcc6664b583cd7b201e0ffba63fcc8873d0af256137742e9f3014b2e20a4363708545e86bb73793d05a92

Download Submit
memory/1356-94-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1356-93-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1356-88-0x00000000004021DA-mapping.dmp

Download
memory/1616-58-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1616-64-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1616-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1616-60-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1616-65-0x00000000004021DA-mapping.dmp

Download
memory/1616-57-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1616-68-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1616-72-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1964-54-0x0000000075401000-0x0000000075403000-memory.dmp

Filesize
8KB

Download
memory/2044-70-0x0000000000000000-mapping.dmp

Download