netwire | b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8

General

Target

b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8.exe
Size

233KB
MD5

b99cb8afddf5ac56bad0efac8bba0f76
SHA1

c72ba87e3f39e807afd0d88cfca9504073fa005d
SHA256

b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8
SHA512

453308eed1dae8670dd3a328dc4ac47557182679748a1127b546ea59110b7b868bf6b8d8a416233558424e16690c068048689f245332a374c8d45845a44acd67

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

vegan.giize.com:1604

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
lock_executable
false
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3008-144-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/3008-146-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/3008-147-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Drops startup file 2 IoCs

Processes:

Powershell.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UieYerEuodMofeNde.exe	Powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UieYerEuodMofeNde.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8.exe

description	pid	process	target process
PID 2708 set thread context of 3008	2708	b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Powershell.exe

pid process

4944 Powershell.exe
4944 Powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 4944 Powershell.exe

pid	process
4944	Powershell.exe
4944	Powershell.exe

description	pid	process
Token: SeDebugPrivilege	4944	Powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8.exe

description	pid	process	target process
PID 2708 wrote to memory of 4944	2708	b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8.exe	Powershell.exe
PID 2708 wrote to memory of 4944	2708	b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8.exe	Powershell.exe
PID 2708 wrote to memory of 4944	2708	b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8.exe	Powershell.exe
PID 2708 wrote to memory of 3008	2708	b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8.exe	RegSvcs.exe
PID 2708 wrote to memory of 3008	2708	b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8.exe	RegSvcs.exe
PID 2708 wrote to memory of 3008	2708	b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8.exe	RegSvcs.exe
PID 2708 wrote to memory of 3008	2708	b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8.exe	RegSvcs.exe
PID 2708 wrote to memory of 3008	2708	b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8.exe	RegSvcs.exe
PID 2708 wrote to memory of 3008	2708	b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8.exe	RegSvcs.exe
PID 2708 wrote to memory of 3008	2708	b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8.exe	RegSvcs.exe
PID 2708 wrote to memory of 3008	2708	b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8.exe	RegSvcs.exe
PID 2708 wrote to memory of 3008	2708	b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8.exe	RegSvcs.exe
PID 2708 wrote to memory of 3008	2708	b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8.exe	RegSvcs.exe
PID 2708 wrote to memory of 3008	2708	b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8.exe
"C:\Users\Admin\AppData\Local\Temp\b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2708

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\b650ac14a0c73c8649b19d76c17fbd2a222ecd799306a58db24b7a3461b8bab8.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UieYerEuodMofeNde.exe'
2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:3008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2708-130-0x0000000000010000-0x0000000000050000-memory.dmp

Filesize
256KB

Download
memory/2708-131-0x00000000049B0000-0x0000000004A4C000-memory.dmp

Filesize
624KB

Download
memory/2708-132-0x0000000005000000-0x00000000055A4000-memory.dmp

Filesize
5.6MB

Download
memory/2708-133-0x0000000004AF0000-0x0000000004B82000-memory.dmp

Filesize
584KB

Download
memory/2708-134-0x0000000004A90000-0x0000000004A9A000-memory.dmp

Filesize
40KB

Download
memory/2708-135-0x0000000004D70000-0x0000000004DC6000-memory.dmp

Filesize
344KB

Download
memory/3008-146-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3008-147-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3008-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3008-143-0x0000000000000000-mapping.dmp

Download
memory/4944-140-0x0000000005B10000-0x0000000005B76000-memory.dmp

Filesize
408KB

Download
memory/4944-141-0x0000000005BF0000-0x0000000005C56000-memory.dmp

Filesize
408KB

Download
memory/4944-142-0x0000000004FE0000-0x0000000004FFE000-memory.dmp

Filesize
120KB

Download
memory/4944-139-0x0000000005430000-0x0000000005452000-memory.dmp

Filesize
136KB

Download
memory/4944-138-0x0000000005460000-0x0000000005A88000-memory.dmp

Filesize
6.2MB

Download
memory/4944-136-0x0000000000000000-mapping.dmp

Download
memory/4944-137-0x00000000028C0000-0x00000000028F6000-memory.dmp

Filesize
216KB

Download
memory/4944-148-0x00000000073D0000-0x0000000007466000-memory.dmp

Filesize
600KB

Download
memory/4944-149-0x0000000006700000-0x000000000671A000-memory.dmp

Filesize
104KB

Download
memory/4944-150-0x0000000006760000-0x0000000006782000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads