netwire | 40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62

General

Target

40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe
Size

175KB
MD5

1d92475e5f11ddf8256835c4bfb196a3
SHA1

c40bc3e3fd25bf6b872b0e7953c9f5d833b522de
SHA256

40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62
SHA512

170fac19f61ade42c378811c6f11e91f62319c0b7ad77a9f1138db867bbd21ad48c54d1b3689b8e1d77be483e1a0b39bfe90dc6935e662c5f87aa823b8fc58d6

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

37.233.101.73:8888

213.152.162.104:8747

213.152.162.170:8747

213.152.162.109:8747

213.152.162.89:8747

109.232.227.138:8747

109.232.227.133:8747

213.152.161.211:8747

213.152.162.94:8747

213.152.161.35:8747

213.152.180.5:8747

Attributes

activex_autorun
true
activex_key
{H15R52OJ-8CJI-H436-22TJ-P25072J3Q326}
copy_executable
true
delete_original
true
host_id
IP
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
true
mutex
bmhJQHdn
offline_keylogger
true
password
DAWAJkurwoKASEniePIERDOL
registry_autorun
true
startup_name
NetWire
use_mutex
true

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/896-61-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral1/memory/1940-69-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral1/memory/1940-70-0x0000000000400000-0x0000000000420000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

Host.exeHost.exe

pid process

1784 Host.exe
1940 Host.exe

pid	process
1784	Host.exe
1940	Host.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{H15R52OJ-8CJI-H436-22TJ-P25072J3Q326}	Host.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{H15R52OJ-8CJI-H436-22TJ-P25072J3Q326}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\""	Host.exe

Deletes itself 1 IoCs

Processes:

Host.exe

pid process

1940 Host.exe

pid	process
1940	Host.exe

Loads dropped DLL 3 IoCs

Processes:

40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exeHost.exe

pid	process
324	40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe
896	40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe
1784	Host.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe"	Host.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exeHost.exe

description	pid	process	target process
PID 324 set thread context of 896	324	40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe	40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe
PID 1784 set thread context of 1940	1784	Host.exe	Host.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 8 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Install\Host.exe	nsis_installer_1
\Users\Admin\AppData\Roaming\Install\Host.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\Install\Host.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\Install\Host.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\Install\Host.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\Install\Host.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\Install\Host.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\Install\Host.exe	nsis_installer_2

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exeHost.exe

pid process

324 40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe
1784 Host.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exeHost.exe

description	pid	process	target process
PID 324 wrote to memory of 896	324	40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe	40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe
PID 324 wrote to memory of 896	324	40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe	40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe
PID 324 wrote to memory of 896	324	40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe	40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe
PID 324 wrote to memory of 896	324	40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe	40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe
PID 324 wrote to memory of 896	324	40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe	40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe
PID 896 wrote to memory of 1784	896	40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe	Host.exe
PID 896 wrote to memory of 1784	896	40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe	Host.exe
PID 896 wrote to memory of 1784	896	40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe	Host.exe
PID 896 wrote to memory of 1784	896	40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe	Host.exe
PID 1784 wrote to memory of 1940	1784	Host.exe	Host.exe
PID 1784 wrote to memory of 1940	1784	Host.exe	Host.exe
PID 1784 wrote to memory of 1940	1784	Host.exe	Host.exe
PID 1784 wrote to memory of 1940	1784	Host.exe	Host.exe
PID 1784 wrote to memory of 1940	1784	Host.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe
"C:\Users\Admin\AppData\Local\Temp\40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:324

C:\Users\Admin\AppData\Local\Temp\40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe
"C:\Users\Admin\AppData\Local\Temp\40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:896

C:\Users\Admin\AppData\Roaming\Install\Host.exe
-m "C:\Users\Admin\AppData\Local\Temp\40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1784

C:\Users\Admin\AppData\Roaming\Install\Host.exe
-m "C:\Users\Admin\AppData\Local\Temp\40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62.exe"
4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Deletes itself
- Adds Run key to start application
PID:1940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nIqpNzmw

Filesize
106KB

MD5
8f96258abd217b7d018f28f3f23742aa

SHA1
d80e6b314de6d0a781ce6771cf3b37abf8220332

SHA256
c9c2c007f6d6e7472c857d8942ccb4d9c678a08781fad6b52f1570a5556ab596

SHA512
a27fb703bc31b8ee519579e67b9a86e0717b5a975ac7237c8cdd063f9412cec0687bfd3664e876bf62e2798aaef302e395c626dceed1e06c702820529ce6d808

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
175KB

MD5
1d92475e5f11ddf8256835c4bfb196a3

SHA1
c40bc3e3fd25bf6b872b0e7953c9f5d833b522de

SHA256
40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62

SHA512
170fac19f61ade42c378811c6f11e91f62319c0b7ad77a9f1138db867bbd21ad48c54d1b3689b8e1d77be483e1a0b39bfe90dc6935e662c5f87aa823b8fc58d6

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
175KB

MD5
1d92475e5f11ddf8256835c4bfb196a3

SHA1
c40bc3e3fd25bf6b872b0e7953c9f5d833b522de

SHA256
40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62

SHA512
170fac19f61ade42c378811c6f11e91f62319c0b7ad77a9f1138db867bbd21ad48c54d1b3689b8e1d77be483e1a0b39bfe90dc6935e662c5f87aa823b8fc58d6

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
175KB

MD5
1d92475e5f11ddf8256835c4bfb196a3

SHA1
c40bc3e3fd25bf6b872b0e7953c9f5d833b522de

SHA256
40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62

SHA512
170fac19f61ade42c378811c6f11e91f62319c0b7ad77a9f1138db867bbd21ad48c54d1b3689b8e1d77be483e1a0b39bfe90dc6935e662c5f87aa823b8fc58d6

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2D78.tmp\System.dll

Filesize
11KB

MD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae

SHA1
fe582246792774c2c9dd15639ffa0aca90d6fd0b

SHA256
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

SHA512
0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

Download Submit
\Users\Admin\AppData\Local\Temp\nsdE16.tmp\System.dll

Filesize
11KB

MD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae

SHA1
fe582246792774c2c9dd15639ffa0aca90d6fd0b

SHA256
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

SHA512
0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

Download Submit
\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
175KB

MD5
1d92475e5f11ddf8256835c4bfb196a3

SHA1
c40bc3e3fd25bf6b872b0e7953c9f5d833b522de

SHA256
40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62

SHA512
170fac19f61ade42c378811c6f11e91f62319c0b7ad77a9f1138db867bbd21ad48c54d1b3689b8e1d77be483e1a0b39bfe90dc6935e662c5f87aa823b8fc58d6

Download Submit
memory/324-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/896-56-0x00000000004022CA-mapping.dmp

Download
memory/896-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1784-59-0x0000000000000000-mapping.dmp

Download
memory/1940-66-0x00000000004022CA-mapping.dmp

Download
memory/1940-69-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1940-70-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads