netwire | 407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010

General

Target

407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
Size

347KB
MD5

6b20559ddfc38ecaff9a92ef76d7f5d6
SHA1

d4658c9a119729e8b24cfe4c042dbee2760a1c7e
SHA256

407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010
SHA512

58013ac1c2d71acc63d0b2534e271b508093c17892732c0661f8118e808e036c05f51d0d79b72f01cfcd5a8838a957da5b15271bfca7b9f5806dcfd7480b63d3

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

info1.nowddns.com:5552

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
SMS-Providers
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
caster
registry_autorun
false
use_mutex
false

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\0hN5416i5n3doh1U\\Ryt6UqdCJwMT.exe\",explorer.exe"	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3244-133-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/3244-135-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/3244-136-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

Processes:

407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe

description	pid	process	target process
PID 4700 set thread context of 3244	4700	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe

pid	process
4700	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
4700	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe

description	pid	process
Token: SeDebugPrivilege	4700	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
Token: SeDebugPrivilege	4700	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe

description	pid	process	target process
PID 4700 wrote to memory of 3244	4700	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 4700 wrote to memory of 3244	4700	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 4700 wrote to memory of 3244	4700	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 4700 wrote to memory of 3244	4700	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 4700 wrote to memory of 3244	4700	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 4700 wrote to memory of 3244	4700	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 4700 wrote to memory of 3244	4700	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 4700 wrote to memory of 3244	4700	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 4700 wrote to memory of 3244	4700	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
PID 4700 wrote to memory of 3244	4700	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe	407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe

C:\Users\Admin\AppData\Local\Temp\407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
"C:\Users\Admin\AppData\Local\Temp\407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700

C:\Users\Admin\AppData\Local\Temp\407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe
"C:\Users\Admin\AppData\Local\Temp\407c9d38f87a36ff78212df9ad63ba3bc67e0232efdb7977440515633b772010.exe"
2⤵
PID:3244

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3244-132-0x0000000000000000-mapping.dmp

Download
memory/3244-133-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3244-135-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3244-136-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4700-130-0x00000000749D0000-0x0000000074F81000-memory.dmp

Filesize
5.7MB

Download
memory/4700-131-0x00000000749D0000-0x0000000074F81000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads