netwire | 500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4

General

Target

500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe
Size

584KB
MD5

8e1d1a09e94f30ec964448c915101d2b
SHA1

c85d5abb51639c3fddd927978c0e5277b5fb941e
SHA256

500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4
SHA512

00d53510186d9009548c83a64d2e5a759df2a9a255919aff8049346903fba5289a6c912274d2e9e08e4e78fc9e0deda3bbaceebe116f369a6cf711ddb7f99ab2

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

moremoney001.ddns.net:1759

10.219.79.74:1616

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
yankee
install_path
%AppData%
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
HsAMvvOf
offline_keylogger
true
password
Password
registry_autorun
true
startup_name
NetWire
use_mutex
true

Signatures

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/956-66-0x0000000000400000-0x0000000000493000-memory.dmp	netwire
behavioral1/memory/956-67-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Local\\Temp\\500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe"	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe

pid	process
1972	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe
956	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe
956	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe

description	pid	process	target process
PID 1972 set thread context of 956	1972	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe

pid process

1972 500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe

description	pid	process	target process
PID 1972 wrote to memory of 956	1972	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe
PID 1972 wrote to memory of 956	1972	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe
PID 1972 wrote to memory of 956	1972	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe
PID 1972 wrote to memory of 956	1972	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe

C:\Users\Admin\AppData\Local\Temp\500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe
"C:\Users\Admin\AppData\Local\Temp\500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972

C:\Users\Admin\AppData\Local\Temp\500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe
"C:\Users\Admin\AppData\Local\Temp\500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe"
2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-61-0x0000000000477461-mapping.dmp

Download
memory/956-66-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/956-67-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/956-73-0x0000000077C10000-0x0000000077DB9000-memory.dmp

Filesize
1.7MB

Download
memory/956-74-0x0000000000220000-0x000000000022E000-memory.dmp

Filesize
56KB

Download
memory/1972-56-0x00000000003C0000-0x00000000003CE000-memory.dmp

Filesize
56KB

Download
memory/1972-57-0x00000000760F1000-0x00000000760F3000-memory.dmp

Filesize
8KB

Download
memory/1972-59-0x0000000077C10000-0x0000000077DB9000-memory.dmp

Filesize
1.7MB

Download
memory/1972-60-0x0000000077DF0000-0x0000000077F70000-memory.dmp

Filesize
1.5MB

Download
memory/1972-62-0x00000000003C0000-0x00000000003CE000-memory.dmp

Filesize
56KB

Download
memory/1972-63-0x0000000077DF0000-0x0000000077F70000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads