netwire

General

Target

5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5
Size

562KB
Sample

220717-c9gvhsdgfn
MD5

bdd639e15d8c88efe5ab1f58608a0302
SHA1

fd99f0cff3ebbc6254c86147096148b41aa31b5f
SHA256

5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5
SHA512

880f7f2401a470c4c157659cec8b3f396233b260a1cc68d698cb0443e88bef56ddf2435e100a1c780956b5cbe5c22906024ef4a90245d1615ebf28fd67efdd85

Score

10^/10

Malware Config

Extracted

Family

netwire

C2

127.0.0.1:3360

elumadns.eluma101.com:4003

elumadns.eluma101.com:4000

jmoney.daniel2you.com:4000

jmoney.daniel2you.com:4003

oluwa101.hopto.org:4003

oluwa101.hopto.org:4000

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
NEWEST_2019
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
BEBSWoHf
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
true

Targets

- Target
  
  5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5
- Size
  
  562KB
- MD5
  
  bdd639e15d8c88efe5ab1f58608a0302
- SHA1
  
  fd99f0cff3ebbc6254c86147096148b41aa31b5f
- SHA256
  
  5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5
- SHA512
  
  880f7f2401a470c4c157659cec8b3f396233b260a1cc68d698cb0443e88bef56ddf2435e100a1c780956b5cbe5c22906024ef4a90245d1615ebf28fd67efdd85
Score

10^/10

netwire bootkit botnet persistence rat stealer
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

NetWire RAT payload

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Writes to the Master Boot Record (MBR)

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2