netwire | 5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5

General

Target

5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5.exe
Size

562KB
MD5

bdd639e15d8c88efe5ab1f58608a0302
SHA1

fd99f0cff3ebbc6254c86147096148b41aa31b5f
SHA256

5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5
SHA512

880f7f2401a470c4c157659cec8b3f396233b260a1cc68d698cb0443e88bef56ddf2435e100a1c780956b5cbe5c22906024ef4a90245d1615ebf28fd67efdd85

Score

10^/10

netwire bootkit botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

127.0.0.1:3360

elumadns.eluma101.com:4003

elumadns.eluma101.com:4000

jmoney.daniel2you.com:4000

jmoney.daniel2you.com:4003

oluwa101.hopto.org:4003

oluwa101.hopto.org:4000

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
NEWEST_2019
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
BEBSWoHf
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1756-69-0x0000000000400000-0x000000000042D000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

Host.exe

pid process

1608 Host.exe
Loads dropped DLL 1 IoCs

Processes:

mstsc.exe

pid process

1756 mstsc.exe

pid	process
1608	Host.exe

pid	process
1756	mstsc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ms OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Macromedia\\StikyNot.exe"	5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5.exe

description ioc process

File opened for modification \??\PhysicalDrive0 5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5.exe

description	pid	process	target process
PID 1964 set thread context of 1756	1964	5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5.exe	mstsc.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5.exemstsc.exe

description	pid	process	target process
PID 1964 wrote to memory of 1756	1964	5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5.exe	mstsc.exe
PID 1964 wrote to memory of 1756	1964	5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5.exe	mstsc.exe
PID 1964 wrote to memory of 1756	1964	5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5.exe	mstsc.exe
PID 1964 wrote to memory of 1756	1964	5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5.exe	mstsc.exe
PID 1964 wrote to memory of 1756	1964	5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5.exe	mstsc.exe
PID 1964 wrote to memory of 1756	1964	5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5.exe	mstsc.exe
PID 1756 wrote to memory of 1608	1756	mstsc.exe	Host.exe
PID 1756 wrote to memory of 1608	1756	mstsc.exe	Host.exe
PID 1756 wrote to memory of 1608	1756	mstsc.exe	Host.exe
PID 1756 wrote to memory of 1608	1756	mstsc.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5.exe
"C:\Users\Admin\AppData\Local\Temp\5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5.exe"
1⤵
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\mstsc.exe
"C:\Windows\System32\mstsc.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1756

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
3⤵
- Executes dropped EXE
PID:1608

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
1.0MB

MD5
68b4a549d0b56a4dd9a488751037cf09

SHA1
fa7137a8cd430ffeb9e869443026dcde540dbcc2

SHA256
a9286688556dbb45303d3a0e7825294f58ffd48e125518ac33ab009426c967cc

SHA512
569c29845e7a82fdc9b2a483175a1674f67a553d23f61057c87d07598ba55fc1a1ad96343409b50d537886ee58b3e849d9d3b0dc8ada7f15e3de2a6a5e3fd66a

Download Submit
\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
1.0MB

MD5
68b4a549d0b56a4dd9a488751037cf09

SHA1
fa7137a8cd430ffeb9e869443026dcde540dbcc2

SHA256
a9286688556dbb45303d3a0e7825294f58ffd48e125518ac33ab009426c967cc

SHA512
569c29845e7a82fdc9b2a483175a1674f67a553d23f61057c87d07598ba55fc1a1ad96343409b50d537886ee58b3e849d9d3b0dc8ada7f15e3de2a6a5e3fd66a

Download Submit
memory/1608-67-0x0000000000000000-mapping.dmp

Download
memory/1756-60-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1756-58-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1756-61-0x000000000042C000-mapping.dmp

Download
memory/1756-65-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1756-69-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1964-54-0x0000000076901000-0x0000000076903000-memory.dmp

Filesize
8KB

Download
memory/1964-63-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/1964-57-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/1964-56-0x0000000000770000-0x00000000007B2000-memory.dmp

Filesize
264KB

Download
memory/1964-55-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads