netwire | 407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010

General

Target

407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
Size

347KB
MD5

6b20559ddfc38ecaff9a92ef76d7f5d6
SHA1

d4658c9a119729e8b24cfe4c042dbee2760a1c7e
SHA256

407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010
SHA512

58013ac1c2d71acc63d0b2534e271b508093c17892732c0661f8118e808e036c05f51d0d79b72f01cfcd5a8838a957da5b15271bfca7b9f5806dcfd7480b63d3

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

info1.nowddns.com:5552

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
SMS-Providers
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
caster
registry_autorun
false
use_mutex
false

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\0hN5416i5n3doh1U\\KhOeZ1RgQEMW.exe\",explorer.exe"	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe

NetWire RAT payload 7 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/684-61-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/684-62-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/684-64-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/684-65-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/684-66-0x0000000000402BCB-mapping.dmp	netwire
behavioral1/memory/684-69-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/684-70-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

Processes:

407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe

description	pid	process	target process
PID 624 set thread context of 684	624	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe

pid	process
624	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
624	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
624	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe

description	pid	process
Token: SeDebugPrivilege	624	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
Token: SeDebugPrivilege	624	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe

C:\Users\Admin\AppData\Local\Temp\407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
"C:\Users\Admin\AppData\Local\Temp\407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:624

C:\Users\Admin\AppData\Local\Temp\407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
"C:\Users\Admin\AppData\Local\Temp\407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe"
2⤵
PID:1500

C:\Users\Admin\AppData\Local\Temp\407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
"C:\Users\Admin\AppData\Local\Temp\407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe"
2⤵
PID:684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-54-0x00000000769D1000-0x00000000769D3000-memory.dmp

Filesize
8KB

Download
memory/624-55-0x0000000074E60000-0x000000007540B000-memory.dmp

Filesize
5.7MB

Download
memory/624-71-0x0000000074E60000-0x000000007540B000-memory.dmp

Filesize
5.7MB

Download
memory/684-62-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/684-59-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/684-61-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/684-57-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/684-64-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/684-65-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/684-66-0x0000000000402BCB-mapping.dmp

Download
memory/684-69-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/684-70-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/684-56-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

description	pid	process	target process
PID 624 wrote to memory of 1500	624	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 624 wrote to memory of 1500	624	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 624 wrote to memory of 1500	624	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 624 wrote to memory of 1500	624	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 624 wrote to memory of 684	624	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 624 wrote to memory of 684	624	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 624 wrote to memory of 684	624	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 624 wrote to memory of 684	624	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 624 wrote to memory of 684	624	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 624 wrote to memory of 684	624	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 624 wrote to memory of 684	624	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 624 wrote to memory of 684	624	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 624 wrote to memory of 684	624	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 624 wrote to memory of 684	624	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 624 wrote to memory of 684	624	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads