netwire | 50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058

General

Target

50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
Size

740KB
MD5

a1b23f02659dab7b195e78a08d5847ca
SHA1

8a51e9c00629ded57754e400d6344c018ab0183a
SHA256

50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058
SHA512

227b9753bda1d150b287fc4da824416e266aadc35212a037eb4665cb9895c267c07fc3be3505039136832a08c93ac03ea28b7a22e3ba7a0a1f94f052a4a99d05

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

amz1.hackermind.info:3360

Attributes

activex_autorun
true
activex_key
{O5IC1RX5-17QA-4B21-K563-M1NR4O07C3VQ}
copy_executable
true
delete_original
true
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Password
registry_autorun
true
startup_name
NetWire
use_mutex
false

Signatures

NetWire RAT payload 7 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3448-133-0x0000000000000000-mapping.dmp	netwire
behavioral2/memory/3448-134-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/3448-136-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/3448-140-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/1860-143-0x0000000000000000-mapping.dmp	netwire
behavioral2/memory/1860-146-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/1860-147-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

Host.exeHost.exe

pid process

4620 Host.exe
1860 Host.exe

pid	process
4620	Host.exe
1860	Host.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{O5IC1RX5-17QA-4B21-K563-M1NR4O07C3VQ}	Host.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{O5IC1RX5-17QA-4B21-K563-M1NR4O07C3VQ}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\""	Host.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2783062828-828903012-4218294845-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783062828-828903012-4218294845-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe"	Host.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exeHost.exe

pid process

2688 50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
4620 Host.exe

pid	process
2688	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
4620	Host.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exeHost.exe

description	pid	process	target process
PID 2688 wrote to memory of 3448	2688	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
PID 2688 wrote to memory of 3448	2688	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
PID 2688 wrote to memory of 3448	2688	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
PID 2688 wrote to memory of 3448	2688	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
PID 2688 wrote to memory of 3448	2688	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
PID 2688 wrote to memory of 3448	2688	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
PID 2688 wrote to memory of 3448	2688	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
PID 2688 wrote to memory of 3448	2688	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
PID 2688 wrote to memory of 3448	2688	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
PID 2688 wrote to memory of 3448	2688	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
PID 2688 wrote to memory of 3448	2688	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
PID 2688 wrote to memory of 3448	2688	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
PID 2688 wrote to memory of 3448	2688	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
PID 2688 wrote to memory of 3448	2688	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
PID 2688 wrote to memory of 3448	2688	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
PID 2688 wrote to memory of 3448	2688	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
PID 2688 wrote to memory of 3448	2688	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
PID 3448 wrote to memory of 4620	3448	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe	Host.exe
PID 3448 wrote to memory of 4620	3448	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe	Host.exe
PID 3448 wrote to memory of 4620	3448	50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe	Host.exe
PID 4620 wrote to memory of 1860	4620	Host.exe	Host.exe
PID 4620 wrote to memory of 1860	4620	Host.exe	Host.exe
PID 4620 wrote to memory of 1860	4620	Host.exe	Host.exe
PID 4620 wrote to memory of 1860	4620	Host.exe	Host.exe
PID 4620 wrote to memory of 1860	4620	Host.exe	Host.exe
PID 4620 wrote to memory of 1860	4620	Host.exe	Host.exe
PID 4620 wrote to memory of 1860	4620	Host.exe	Host.exe
PID 4620 wrote to memory of 1860	4620	Host.exe	Host.exe
PID 4620 wrote to memory of 1860	4620	Host.exe	Host.exe
PID 4620 wrote to memory of 1860	4620	Host.exe	Host.exe
PID 4620 wrote to memory of 1860	4620	Host.exe	Host.exe
PID 4620 wrote to memory of 1860	4620	Host.exe	Host.exe
PID 4620 wrote to memory of 1860	4620	Host.exe	Host.exe
PID 4620 wrote to memory of 1860	4620	Host.exe	Host.exe
PID 4620 wrote to memory of 1860	4620	Host.exe	Host.exe
PID 4620 wrote to memory of 1860	4620	Host.exe	Host.exe
PID 4620 wrote to memory of 1860	4620	Host.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
"C:\Users\Admin\AppData\Local\Temp\50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688

C:\Users\Admin\AppData\Local\Temp\50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe
"C:\Users\Admin\AppData\Local\Temp\50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3448

C:\Users\Admin\AppData\Roaming\Install\Host.exe
-m "C:\Users\Admin\AppData\Local\Temp\50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4620

C:\Users\Admin\AppData\Roaming\Install\Host.exe
-m "C:\Users\Admin\AppData\Local\Temp\50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058.exe"
4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:1860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
740KB

MD5
a1b23f02659dab7b195e78a08d5847ca

SHA1
8a51e9c00629ded57754e400d6344c018ab0183a

SHA256
50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058

SHA512
227b9753bda1d150b287fc4da824416e266aadc35212a037eb4665cb9895c267c07fc3be3505039136832a08c93ac03ea28b7a22e3ba7a0a1f94f052a4a99d05

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
740KB

MD5
a1b23f02659dab7b195e78a08d5847ca

SHA1
8a51e9c00629ded57754e400d6344c018ab0183a

SHA256
50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058

SHA512
227b9753bda1d150b287fc4da824416e266aadc35212a037eb4665cb9895c267c07fc3be3505039136832a08c93ac03ea28b7a22e3ba7a0a1f94f052a4a99d05

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
740KB

MD5
a1b23f02659dab7b195e78a08d5847ca

SHA1
8a51e9c00629ded57754e400d6344c018ab0183a

SHA256
50ac1329dbc10441a42cfb745392c68a022bda8ef5ffbe29a65cbb801672a058

SHA512
227b9753bda1d150b287fc4da824416e266aadc35212a037eb4665cb9895c267c07fc3be3505039136832a08c93ac03ea28b7a22e3ba7a0a1f94f052a4a99d05

Download Submit
memory/1860-143-0x0000000000000000-mapping.dmp

Download
memory/1860-146-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1860-147-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2688-135-0x00000000023D0000-0x00000000023D6000-memory.dmp

Filesize
24KB

Download
memory/2688-132-0x00000000023D0000-0x00000000023D6000-memory.dmp

Filesize
24KB

Download
memory/3448-136-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3448-134-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3448-140-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3448-133-0x0000000000000000-mapping.dmp

Download
memory/4620-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads