netwire | 4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af

General

Target

4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
Size

648KB
MD5

7c958c25fd6e816da044bcd23f37940a
SHA1

e95cf0c3d58448cf0e9ff8b53ca6ecff10a81246
SHA256

4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af
SHA512

08f22b747697c3060f14834c321203c7eacdbe1f053dbe3044a3810a030ba9da26746b64d3ed956741fa5465c868b0d00d692c89a2538d038d973fb43a072724

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

ggggg.ddns.net:3360

boow.ddns.net:3360

Attributes

activex_autorun
false
copy_executable
true
delete_original
true
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
true
mutex
OnVjhkkv
offline_keylogger
true
password
Password
registry_autorun
true
startup_name
NetWire
use_mutex
true

Signatures

NetWire RAT payload 7 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4916-133-0x0000000000000000-mapping.dmp	netwire
behavioral2/memory/4916-134-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/4916-136-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/4916-137-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/4436-143-0x0000000000000000-mapping.dmp	netwire
behavioral2/memory/4436-147-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/4436-148-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

Host.exeHost.exe

pid process

2660 Host.exe
4436 Host.exe

pid	process
2660	Host.exe
4436	Host.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe"	Host.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exeHost.exe

pid process

1008 4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
2660 Host.exe

pid	process
1008	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
2660	Host.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exeHost.exe

description	pid	process	target process
PID 1008 wrote to memory of 4916	1008	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1008 wrote to memory of 4916	1008	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1008 wrote to memory of 4916	1008	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1008 wrote to memory of 4916	1008	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1008 wrote to memory of 4916	1008	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1008 wrote to memory of 4916	1008	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1008 wrote to memory of 4916	1008	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1008 wrote to memory of 4916	1008	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1008 wrote to memory of 4916	1008	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1008 wrote to memory of 4916	1008	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1008 wrote to memory of 4916	1008	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1008 wrote to memory of 4916	1008	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1008 wrote to memory of 4916	1008	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1008 wrote to memory of 4916	1008	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1008 wrote to memory of 4916	1008	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1008 wrote to memory of 4916	1008	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 1008 wrote to memory of 4916	1008	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
PID 4916 wrote to memory of 2660	4916	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	Host.exe
PID 4916 wrote to memory of 2660	4916	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	Host.exe
PID 4916 wrote to memory of 2660	4916	4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe	Host.exe
PID 2660 wrote to memory of 4436	2660	Host.exe	Host.exe
PID 2660 wrote to memory of 4436	2660	Host.exe	Host.exe
PID 2660 wrote to memory of 4436	2660	Host.exe	Host.exe
PID 2660 wrote to memory of 4436	2660	Host.exe	Host.exe
PID 2660 wrote to memory of 4436	2660	Host.exe	Host.exe
PID 2660 wrote to memory of 4436	2660	Host.exe	Host.exe
PID 2660 wrote to memory of 4436	2660	Host.exe	Host.exe
PID 2660 wrote to memory of 4436	2660	Host.exe	Host.exe
PID 2660 wrote to memory of 4436	2660	Host.exe	Host.exe
PID 2660 wrote to memory of 4436	2660	Host.exe	Host.exe
PID 2660 wrote to memory of 4436	2660	Host.exe	Host.exe
PID 2660 wrote to memory of 4436	2660	Host.exe	Host.exe
PID 2660 wrote to memory of 4436	2660	Host.exe	Host.exe
PID 2660 wrote to memory of 4436	2660	Host.exe	Host.exe
PID 2660 wrote to memory of 4436	2660	Host.exe	Host.exe
PID 2660 wrote to memory of 4436	2660	Host.exe	Host.exe
PID 2660 wrote to memory of 4436	2660	Host.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
"C:\Users\Admin\AppData\Local\Temp\4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008

C:\Users\Admin\AppData\Local\Temp\4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe
"C:\Users\Admin\AppData\Local\Temp\4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4916

C:\Users\Admin\AppData\Roaming\Install\Host.exe
-m "C:\Users\Admin\AppData\Local\Temp\4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660

C:\Users\Admin\AppData\Roaming\Install\Host.exe
-m "C:\Users\Admin\AppData\Local\Temp\4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
648KB

MD5
7c958c25fd6e816da044bcd23f37940a

SHA1
e95cf0c3d58448cf0e9ff8b53ca6ecff10a81246

SHA256
4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af

SHA512
08f22b747697c3060f14834c321203c7eacdbe1f053dbe3044a3810a030ba9da26746b64d3ed956741fa5465c868b0d00d692c89a2538d038d973fb43a072724

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
648KB

MD5
7c958c25fd6e816da044bcd23f37940a

SHA1
e95cf0c3d58448cf0e9ff8b53ca6ecff10a81246

SHA256
4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af

SHA512
08f22b747697c3060f14834c321203c7eacdbe1f053dbe3044a3810a030ba9da26746b64d3ed956741fa5465c868b0d00d692c89a2538d038d973fb43a072724

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
648KB

MD5
7c958c25fd6e816da044bcd23f37940a

SHA1
e95cf0c3d58448cf0e9ff8b53ca6ecff10a81246

SHA256
4a157f302bd6afd4079720dbc7028a8caae9b2d2b192ee4f4a6915dec94cd5af

SHA512
08f22b747697c3060f14834c321203c7eacdbe1f053dbe3044a3810a030ba9da26746b64d3ed956741fa5465c868b0d00d692c89a2538d038d973fb43a072724

Download Submit
memory/1008-135-0x0000000000780000-0x0000000000786000-memory.dmp

Filesize
24KB

Download
memory/1008-132-0x0000000000780000-0x0000000000786000-memory.dmp

Filesize
24KB

Download
memory/2660-138-0x0000000000000000-mapping.dmp

Download
memory/4436-143-0x0000000000000000-mapping.dmp

Download
memory/4436-147-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4436-148-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4916-136-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4916-137-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4916-134-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4916-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads