netwire | 507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1

General

Target

507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
Size

780KB
MD5

24bc8e6bea3028f45e8862a845a2ee9b
SHA1

6d31f6ca00d355fe8dc779b377a0f1a7ce677970
SHA256

507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1
SHA512

2c09d97b9034f33ed57292b2e5cd546745be725f3529007b04ba70c5057433d4011be4bbd90c483b8cc11a6e0d716cbe72338b36336a796d0b72d01437300e90

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

127.0.0.1:3360

192.3.24.231:3360

Attributes

activex_autorun
true
activex_key
{W41B645X-8AWL-1GUS-6R75-0DDXP4YA48S8}
copy_executable
true
delete_original
false
host_id
wolla
install_path
%AppData%\Windowsmedialites\windowsdfender.exe
keylogger_dir
%AppData%\Mediaupdater\
lock_executable
false
mutex
PLwAEmqL
offline_keylogger
true
password
Zynova@56070
registry_autorun
true
startup_name
windowsdfender
use_mutex
true

Signatures

NetWire RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/264-133-0x0000000000000000-mapping.dmp	netwire
behavioral2/memory/264-135-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/264-136-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/264-139-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/3996-143-0x0000000000000000-mapping.dmp	netwire
behavioral2/memory/3996-147-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

windowsdfender.exewindowsdfender.exe

pid process

376 windowsdfender.exe
3996 windowsdfender.exe

pid	process
376	windowsdfender.exe
3996	windowsdfender.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

windowsdfender.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{W41B645X-8AWL-1GUS-6R75-0DDXP4YA48S8}	windowsdfender.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{W41B645X-8AWL-1GUS-6R75-0DDXP4YA48S8}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windowsmedialites\\windowsdfender.exe\""	windowsdfender.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

windowsdfender.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	windowsdfender.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windowsdfender = "C:\\Users\\Admin\\AppData\\Roaming\\Windowsmedialites\\windowsdfender.exe"	windowsdfender.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exewindowsdfender.exe

pid process

3856 507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
376 windowsdfender.exe

pid	process
3856	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
376	windowsdfender.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exewindowsdfender.exe

description	pid	process	target process
PID 3856 wrote to memory of 264	3856	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
PID 3856 wrote to memory of 264	3856	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
PID 3856 wrote to memory of 264	3856	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
PID 3856 wrote to memory of 264	3856	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
PID 3856 wrote to memory of 264	3856	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
PID 3856 wrote to memory of 264	3856	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
PID 3856 wrote to memory of 264	3856	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
PID 3856 wrote to memory of 264	3856	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
PID 3856 wrote to memory of 264	3856	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
PID 3856 wrote to memory of 264	3856	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
PID 3856 wrote to memory of 264	3856	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
PID 3856 wrote to memory of 264	3856	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
PID 3856 wrote to memory of 264	3856	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
PID 3856 wrote to memory of 264	3856	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
PID 3856 wrote to memory of 264	3856	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
PID 3856 wrote to memory of 264	3856	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
PID 3856 wrote to memory of 264	3856	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
PID 264 wrote to memory of 376	264	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe	windowsdfender.exe
PID 264 wrote to memory of 376	264	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe	windowsdfender.exe
PID 264 wrote to memory of 376	264	507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe	windowsdfender.exe
PID 376 wrote to memory of 3996	376	windowsdfender.exe	windowsdfender.exe
PID 376 wrote to memory of 3996	376	windowsdfender.exe	windowsdfender.exe
PID 376 wrote to memory of 3996	376	windowsdfender.exe	windowsdfender.exe
PID 376 wrote to memory of 3996	376	windowsdfender.exe	windowsdfender.exe
PID 376 wrote to memory of 3996	376	windowsdfender.exe	windowsdfender.exe
PID 376 wrote to memory of 3996	376	windowsdfender.exe	windowsdfender.exe
PID 376 wrote to memory of 3996	376	windowsdfender.exe	windowsdfender.exe
PID 376 wrote to memory of 3996	376	windowsdfender.exe	windowsdfender.exe
PID 376 wrote to memory of 3996	376	windowsdfender.exe	windowsdfender.exe
PID 376 wrote to memory of 3996	376	windowsdfender.exe	windowsdfender.exe
PID 376 wrote to memory of 3996	376	windowsdfender.exe	windowsdfender.exe
PID 376 wrote to memory of 3996	376	windowsdfender.exe	windowsdfender.exe
PID 376 wrote to memory of 3996	376	windowsdfender.exe	windowsdfender.exe
PID 376 wrote to memory of 3996	376	windowsdfender.exe	windowsdfender.exe
PID 376 wrote to memory of 3996	376	windowsdfender.exe	windowsdfender.exe
PID 376 wrote to memory of 3996	376	windowsdfender.exe	windowsdfender.exe
PID 376 wrote to memory of 3996	376	windowsdfender.exe	windowsdfender.exe

C:\Users\Admin\AppData\Local\Temp\507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
"C:\Users\Admin\AppData\Local\Temp\507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3856

C:\Users\Admin\AppData\Local\Temp\507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe
"C:\Users\Admin\AppData\Local\Temp\507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:264

C:\Users\Admin\AppData\Roaming\Windowsmedialites\windowsdfender.exe
"C:\Users\Admin\AppData\Roaming\Windowsmedialites\windowsdfender.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:376

C:\Users\Admin\AppData\Roaming\Windowsmedialites\windowsdfender.exe
"C:\Users\Admin\AppData\Roaming\Windowsmedialites\windowsdfender.exe"
4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:3996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Windowsmedialites\windowsdfender.exe

Filesize
780KB

MD5
24bc8e6bea3028f45e8862a845a2ee9b

SHA1
6d31f6ca00d355fe8dc779b377a0f1a7ce677970

SHA256
507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1

SHA512
2c09d97b9034f33ed57292b2e5cd546745be725f3529007b04ba70c5057433d4011be4bbd90c483b8cc11a6e0d716cbe72338b36336a796d0b72d01437300e90

Download Submit
C:\Users\Admin\AppData\Roaming\Windowsmedialites\windowsdfender.exe

Filesize
780KB

MD5
24bc8e6bea3028f45e8862a845a2ee9b

SHA1
6d31f6ca00d355fe8dc779b377a0f1a7ce677970

SHA256
507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1

SHA512
2c09d97b9034f33ed57292b2e5cd546745be725f3529007b04ba70c5057433d4011be4bbd90c483b8cc11a6e0d716cbe72338b36336a796d0b72d01437300e90

Download Submit
C:\Users\Admin\AppData\Roaming\Windowsmedialites\windowsdfender.exe

Filesize
780KB

MD5
24bc8e6bea3028f45e8862a845a2ee9b

SHA1
6d31f6ca00d355fe8dc779b377a0f1a7ce677970

SHA256
507cdb533ae17e2796a585b6c6cbb8b2e116fae2dc26209799df93333d40a0c1

SHA512
2c09d97b9034f33ed57292b2e5cd546745be725f3529007b04ba70c5057433d4011be4bbd90c483b8cc11a6e0d716cbe72338b36336a796d0b72d01437300e90

Download Submit
memory/264-133-0x0000000000000000-mapping.dmp

Download
memory/264-135-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/264-136-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/264-139-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/376-137-0x0000000000000000-mapping.dmp

Download
memory/3856-132-0x00000000007F0000-0x00000000007F6000-memory.dmp

Filesize
24KB

Download
memory/3856-134-0x00000000007F0000-0x00000000007F6000-memory.dmp

Filesize
24KB

Download
memory/3996-143-0x0000000000000000-mapping.dmp

Download
memory/3996-147-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads