netwire | 4728b2a6eb6d440411e14091b50e815115c1967d317d1387580994276ac7df9e

General

Target

4728b2a6eb6d440411e14091b50e815115c1967d317d1387580994276ac7df9e.exe
Size

107KB
MD5

24e0f93c0f69bcb4f1f31b6eeb675a8c
SHA1

09fd08d23d1c3208c8938a93238a9a0ff2d9978c
SHA256

4728b2a6eb6d440411e14091b50e815115c1967d317d1387580994276ac7df9e
SHA512

7ec7daad5df6b5e87e731e1aff50b8414307ca5f145e37622fe77326deb584d51931e78e537c2ede00b9df0b18af0393eac7cd43f43e803ca1e6fc410fa247b6

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

127.0.0.1:2011

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
owWnuNuh
offline_keylogger
true
password
nhN5eDxxFW
registry_autorun
true
startup_name
NetWire
use_mutex
true

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Install\Host.exe	netwire
\Users\Admin\AppData\Roaming\Install\Host.exe	netwire
C:\Users\Admin\AppData\Roaming\Install\Host.exe	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

Host.exe

pid process

1904 Host.exe

pid	process
1904	Host.exe

Loads dropped DLL 2 IoCs

Processes:

4728b2a6eb6d440411e14091b50e815115c1967d317d1387580994276ac7df9e.exe

pid	process
1964	4728b2a6eb6d440411e14091b50e815115c1967d317d1387580994276ac7df9e.exe
1964	4728b2a6eb6d440411e14091b50e815115c1967d317d1387580994276ac7df9e.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe"	Host.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4728b2a6eb6d440411e14091b50e815115c1967d317d1387580994276ac7df9e.exe

description	pid	process	target process
PID 1964 wrote to memory of 1904	1964	4728b2a6eb6d440411e14091b50e815115c1967d317d1387580994276ac7df9e.exe	Host.exe
PID 1964 wrote to memory of 1904	1964	4728b2a6eb6d440411e14091b50e815115c1967d317d1387580994276ac7df9e.exe	Host.exe
PID 1964 wrote to memory of 1904	1964	4728b2a6eb6d440411e14091b50e815115c1967d317d1387580994276ac7df9e.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\4728b2a6eb6d440411e14091b50e815115c1967d317d1387580994276ac7df9e.exe
"C:\Users\Admin\AppData\Local\Temp\4728b2a6eb6d440411e14091b50e815115c1967d317d1387580994276ac7df9e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
107KB

MD5
24e0f93c0f69bcb4f1f31b6eeb675a8c

SHA1
09fd08d23d1c3208c8938a93238a9a0ff2d9978c

SHA256
4728b2a6eb6d440411e14091b50e815115c1967d317d1387580994276ac7df9e

SHA512
7ec7daad5df6b5e87e731e1aff50b8414307ca5f145e37622fe77326deb584d51931e78e537c2ede00b9df0b18af0393eac7cd43f43e803ca1e6fc410fa247b6

Download Submit
\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
107KB

MD5
24e0f93c0f69bcb4f1f31b6eeb675a8c

SHA1
09fd08d23d1c3208c8938a93238a9a0ff2d9978c

SHA256
4728b2a6eb6d440411e14091b50e815115c1967d317d1387580994276ac7df9e

SHA512
7ec7daad5df6b5e87e731e1aff50b8414307ca5f145e37622fe77326deb584d51931e78e537c2ede00b9df0b18af0393eac7cd43f43e803ca1e6fc410fa247b6

Download Submit
\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
107KB

MD5
24e0f93c0f69bcb4f1f31b6eeb675a8c

SHA1
09fd08d23d1c3208c8938a93238a9a0ff2d9978c

SHA256
4728b2a6eb6d440411e14091b50e815115c1967d317d1387580994276ac7df9e

SHA512
7ec7daad5df6b5e87e731e1aff50b8414307ca5f145e37622fe77326deb584d51931e78e537c2ede00b9df0b18af0393eac7cd43f43e803ca1e6fc410fa247b6

Download Submit
memory/1904-57-0x0000000000000000-mapping.dmp

Download
memory/1964-54-0x000007FEFC021000-0x000007FEFC023000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads