netwire | 500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4

General

Target

500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe
Size

584KB
MD5

8e1d1a09e94f30ec964448c915101d2b
SHA1

c85d5abb51639c3fddd927978c0e5277b5fb941e
SHA256

500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4
SHA512

00d53510186d9009548c83a64d2e5a759df2a9a255919aff8049346903fba5289a6c912274d2e9e08e4e78fc9e0deda3bbaceebe116f369a6cf711ddb7f99ab2

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

moremoney001.ddns.net:1759

10.219.79.74:1616

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
yankee
install_path
%AppData%
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
HsAMvvOf
offline_keylogger
true
password
Password
registry_autorun
true
startup_name
NetWire
use_mutex
true

Signatures

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1648-138-0x0000000000400000-0x0000000000493000-memory.dmp	netwire
behavioral2/memory/1648-139-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2783062828-828903012-4218294845-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783062828-828903012-4218294845-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Local\\Temp\\500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe"	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe

pid	process
3352	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe
1648	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe
1648	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe

description	pid	process	target process
PID 3352 set thread context of 1648	3352	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe

pid process

3352 500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe

description	pid	process	target process
PID 3352 wrote to memory of 1648	3352	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe
PID 3352 wrote to memory of 1648	3352	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe
PID 3352 wrote to memory of 1648	3352	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe	500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe

C:\Users\Admin\AppData\Local\Temp\500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe
"C:\Users\Admin\AppData\Local\Temp\500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3352

C:\Users\Admin\AppData\Local\Temp\500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe
"C:\Users\Admin\AppData\Local\Temp\500808c33b37f95c8cddbce21d8a69bbbc2270a78c9771df69435cdd80794ad4.exe"
2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-135-0x0000000000000000-mapping.dmp

Download
memory/1648-138-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1648-139-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1648-145-0x00007FFE280B0000-0x00007FFE282A5000-memory.dmp

Filesize
2.0MB

Download
memory/1648-146-0x0000000076F30000-0x00000000770D3000-memory.dmp

Filesize
1.6MB

Download
memory/1648-147-0x00000000005B0000-0x00000000005BE000-memory.dmp

Filesize
56KB

Download
memory/1648-148-0x0000000076F30000-0x00000000770D3000-memory.dmp

Filesize
1.6MB

Download
memory/3352-132-0x0000000002240000-0x000000000224E000-memory.dmp

Filesize
56KB

Download
memory/3352-133-0x00007FFE280B0000-0x00007FFE282A5000-memory.dmp

Filesize
2.0MB

Download
memory/3352-134-0x0000000076F30000-0x00000000770D3000-memory.dmp

Filesize
1.6MB

Download
memory/3352-136-0x0000000002240000-0x000000000224E000-memory.dmp

Filesize
56KB

Download
memory/3352-137-0x0000000076F30000-0x00000000770D3000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads