netwire | 8d14cdd3d37291e30726d6a54012503a974d8b3a7107173f71b839cb4e679ebe

General

Target

Confirmation Slip.exe
Size

997KB
MD5

f39a843414e28e92bbc08f7f95f36b48
SHA1

fef5d5afb0c62b01b75d186f810edd876a98b088
SHA256

8d14cdd3d37291e30726d6a54012503a974d8b3a7107173f71b839cb4e679ebe
SHA512

5546ae7e33eb1a44b261e2df05b4fd31b9d6795443d623554753b0a31fb657cfd88c1ea8c35d971ab281225e22c5eb30699db222bcab57b48aa69076ee69a7c5

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

185.140.53.61:3363

185.140.53.61:3365

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
move4ward
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3024-140-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/3024-142-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/3024-143-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Confirmation Slip.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2280897447-3291712302-3137480060-1000\Control Panel\International\Geo\Nation	Confirmation Slip.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Confirmation Slip.exe

description pid process target process

PID 4692 set thread context of 3024 4692 Confirmation Slip.exe Confirmation Slip.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

260 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Confirmation Slip.exe

pid process

4692 Confirmation Slip.exe
4692 Confirmation Slip.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Confirmation Slip.exe

description pid process

Token: SeDebugPrivilege 4692 Confirmation Slip.exe

description	pid	process	target process
PID 4692 set thread context of 3024	4692	Confirmation Slip.exe	Confirmation Slip.exe

pid	process
260	schtasks.exe

pid	process
4692	Confirmation Slip.exe
4692	Confirmation Slip.exe

description	pid	process
Token: SeDebugPrivilege	4692	Confirmation Slip.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Confirmation Slip.exe

description	pid	process	target process
PID 4692 wrote to memory of 260	4692	Confirmation Slip.exe	schtasks.exe
PID 4692 wrote to memory of 260	4692	Confirmation Slip.exe	schtasks.exe
PID 4692 wrote to memory of 260	4692	Confirmation Slip.exe	schtasks.exe
PID 4692 wrote to memory of 3016	4692	Confirmation Slip.exe	Confirmation Slip.exe
PID 4692 wrote to memory of 3016	4692	Confirmation Slip.exe	Confirmation Slip.exe
PID 4692 wrote to memory of 3016	4692	Confirmation Slip.exe	Confirmation Slip.exe
PID 4692 wrote to memory of 3024	4692	Confirmation Slip.exe	Confirmation Slip.exe
PID 4692 wrote to memory of 3024	4692	Confirmation Slip.exe	Confirmation Slip.exe
PID 4692 wrote to memory of 3024	4692	Confirmation Slip.exe	Confirmation Slip.exe
PID 4692 wrote to memory of 3024	4692	Confirmation Slip.exe	Confirmation Slip.exe
PID 4692 wrote to memory of 3024	4692	Confirmation Slip.exe	Confirmation Slip.exe
PID 4692 wrote to memory of 3024	4692	Confirmation Slip.exe	Confirmation Slip.exe
PID 4692 wrote to memory of 3024	4692	Confirmation Slip.exe	Confirmation Slip.exe
PID 4692 wrote to memory of 3024	4692	Confirmation Slip.exe	Confirmation Slip.exe
PID 4692 wrote to memory of 3024	4692	Confirmation Slip.exe	Confirmation Slip.exe
PID 4692 wrote to memory of 3024	4692	Confirmation Slip.exe	Confirmation Slip.exe
PID 4692 wrote to memory of 3024	4692	Confirmation Slip.exe	Confirmation Slip.exe

C:\Users\Admin\AppData\Local\Temp\Confirmation Slip.exe
"C:\Users\Admin\AppData\Local\Temp\Confirmation Slip.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YPDRvcu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1807.tmp"
2⤵
- Creates scheduled task(s)
PID:260

C:\Users\Admin\AppData\Local\Temp\Confirmation Slip.exe
"{path}"
2⤵
PID:3016

C:\Users\Admin\AppData\Local\Temp\Confirmation Slip.exe
"{path}"
2⤵
PID:3024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1807.tmp

Filesize
1KB

MD5
e75bed927afd920429c16c62c40646a9

SHA1
22a2b4eda98bb0aa0978cc1e1dad86aa58331d09

SHA256
664ad419ac0b2feb74d8a893c0ee13cd47ca5dc1b4911430756e95fa7cb5bb93

SHA512
feec077e5c0e10b3c0480c49e217c12b0780a69ff9138597bad74acd55bcc71fd78dc4a025b3d1378e4326b5e5adcaabdf13ca39d5723c37acfff5b2a9631e3d

Download Submit
memory/260-136-0x0000000000000000-mapping.dmp

Download
memory/3016-138-0x0000000000000000-mapping.dmp

Download
memory/3024-139-0x0000000000000000-mapping.dmp

Download
memory/3024-140-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3024-142-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3024-143-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4692-134-0x00000000057C0000-0x00000000057CA000-memory.dmp

Filesize
40KB

Download
memory/4692-135-0x00000000059A0000-0x00000000059F6000-memory.dmp

Filesize
344KB

Download
memory/4692-133-0x00000000058A0000-0x0000000005932000-memory.dmp

Filesize
584KB

Download
memory/4692-132-0x0000000005E50000-0x00000000063F4000-memory.dmp

Filesize
5.6MB

Download
memory/4692-131-0x0000000005800000-0x000000000589C000-memory.dmp

Filesize
624KB

Download
memory/4692-130-0x0000000000D40000-0x0000000000E40000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads