netwire | 4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af

General

Target

4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
Size

648KB
MD5

7c958c25fd6e816da044bcd23f37940a
SHA1

e95cf0c3d58448cf0e9ff8b53ca6ecff10a81246
SHA256

4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af
SHA512

08f22b747697c3060f14834c321203c7eacdbe1f053dbe3044a3810a030ba9da26746b64d3ed956741fa5465c868b0d00d692c89a2538d038d973fb43a072724

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

ggggg.ddns.net:3360

boow.ddns.net:3360

Attributes

activex_autorun
false
copy_executable
true
delete_original
true
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
true
mutex
OnVjhkkv
offline_keylogger
true
password
Password
registry_autorun
true
startup_name
NetWire
use_mutex
true

Signatures

NetWire RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1388-58-0x0000000000000000-mapping.dmp	netwire
behavioral1/memory/1388-60-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/1388-62-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/1388-67-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/2000-72-0x0000000000000000-mapping.dmp	netwire
behavioral1/memory/2000-76-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/2000-77-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/2000-78-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

Host.exeHost.exe

pid process

1656 Host.exe
2000 Host.exe
Deletes itself 1 IoCs

Processes:

Host.exe

pid process

2000 Host.exe

pid	process
1656	Host.exe
2000	Host.exe

pid	process
2000	Host.exe

Loads dropped DLL 2 IoCs

Processes:

4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe

pid	process
1388	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
1388	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe"	Host.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exeHost.exe

pid process

1580 4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
1656 Host.exe

pid	process
1580	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
1656	Host.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exeHost.exe

description	pid	process	target process
PID 1580 wrote to memory of 1388	1580	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1580 wrote to memory of 1388	1580	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1580 wrote to memory of 1388	1580	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1580 wrote to memory of 1388	1580	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1580 wrote to memory of 1388	1580	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1580 wrote to memory of 1388	1580	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1580 wrote to memory of 1388	1580	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1580 wrote to memory of 1388	1580	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1580 wrote to memory of 1388	1580	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1580 wrote to memory of 1388	1580	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1580 wrote to memory of 1388	1580	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1580 wrote to memory of 1388	1580	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1580 wrote to memory of 1388	1580	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1580 wrote to memory of 1388	1580	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1580 wrote to memory of 1388	1580	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1580 wrote to memory of 1388	1580	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1580 wrote to memory of 1388	1580	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1580 wrote to memory of 1388	1580	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1388 wrote to memory of 1656	1388	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	Host.exe
PID 1388 wrote to memory of 1656	1388	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	Host.exe
PID 1388 wrote to memory of 1656	1388	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	Host.exe
PID 1388 wrote to memory of 1656	1388	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	Host.exe
PID 1656 wrote to memory of 2000	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 2000	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 2000	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 2000	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 2000	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 2000	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 2000	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 2000	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 2000	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 2000	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 2000	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 2000	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 2000	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 2000	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 2000	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 2000	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 2000	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 2000	1656	Host.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
"C:\Users\Admin\AppData\Local\Temp\4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580

C:\Users\Admin\AppData\Local\Temp\4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
"C:\Users\Admin\AppData\Local\Temp\4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1388

C:\Users\Admin\AppData\Roaming\Install\Host.exe
-m "C:\Users\Admin\AppData\Local\Temp\4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656

C:\Users\Admin\AppData\Roaming\Install\Host.exe
-m "C:\Users\Admin\AppData\Local\Temp\4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe"
4⤵
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
648KB

MD5
7c958c25fd6e816da044bcd23f37940a

SHA1
e95cf0c3d58448cf0e9ff8b53ca6ecff10a81246

SHA256
4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af

SHA512
08f22b747697c3060f14834c321203c7eacdbe1f053dbe3044a3810a030ba9da26746b64d3ed956741fa5465c868b0d00d692c89a2538d038d973fb43a072724

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
648KB

MD5
7c958c25fd6e816da044bcd23f37940a

SHA1
e95cf0c3d58448cf0e9ff8b53ca6ecff10a81246

SHA256
4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af

SHA512
08f22b747697c3060f14834c321203c7eacdbe1f053dbe3044a3810a030ba9da26746b64d3ed956741fa5465c868b0d00d692c89a2538d038d973fb43a072724

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
648KB

MD5
7c958c25fd6e816da044bcd23f37940a

SHA1
e95cf0c3d58448cf0e9ff8b53ca6ecff10a81246

SHA256
4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af

SHA512
08f22b747697c3060f14834c321203c7eacdbe1f053dbe3044a3810a030ba9da26746b64d3ed956741fa5465c868b0d00d692c89a2538d038d973fb43a072724

Download Submit
\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
648KB

MD5
7c958c25fd6e816da044bcd23f37940a

SHA1
e95cf0c3d58448cf0e9ff8b53ca6ecff10a81246

SHA256
4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af

SHA512
08f22b747697c3060f14834c321203c7eacdbe1f053dbe3044a3810a030ba9da26746b64d3ed956741fa5465c868b0d00d692c89a2538d038d973fb43a072724

Download Submit
\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
648KB

MD5
7c958c25fd6e816da044bcd23f37940a

SHA1
e95cf0c3d58448cf0e9ff8b53ca6ecff10a81246

SHA256
4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af

SHA512
08f22b747697c3060f14834c321203c7eacdbe1f053dbe3044a3810a030ba9da26746b64d3ed956741fa5465c868b0d00d692c89a2538d038d973fb43a072724

Download Submit
memory/1388-60-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1388-62-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1388-67-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1388-58-0x0000000000000000-mapping.dmp

Download
memory/1580-56-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/1580-59-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/1580-57-0x00000000752A1000-0x00000000752A3000-memory.dmp

Filesize
8KB

Download
memory/1656-65-0x0000000000000000-mapping.dmp

Download
memory/2000-72-0x0000000000000000-mapping.dmp

Download
memory/2000-76-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2000-77-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2000-78-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads