netwire | 59d3f41859d239271e8f15cf8a26ba3e3af04bd28f94584aa74e159861cf0acb

General

Target

59d3f41859d239271e8f15cf8a26ba3e3af04bd28f94584aa74e159861cf0acb.exe
Size

488KB
MD5

48fa86848e56656e699ace8b49c2841a
SHA1

e9d0b4f2a588f7cec6639b54aa1468e7e9b189c6
SHA256

59d3f41859d239271e8f15cf8a26ba3e3af04bd28f94584aa74e159861cf0acb
SHA512

735a7e838140617035c853990275d3cf2bb2c806d089a5b2b97de9f7b002d200b1abe59895b15307c8dd24b2c3ec3b5ec429266056fd4a6e8c88770f6e771002

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

185.208.211.136:3368

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
UIOnYWdp
offline_keylogger
true
password
Gentle123
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1080-145-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

Diskmedier4.exe

pid process

1080 Diskmedier4.exe

pid	process
1080	Diskmedier4.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

59d3f41859d239271e8f15cf8a26ba3e3af04bd28f94584aa74e159861cf0acb.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation	59d3f41859d239271e8f15cf8a26ba3e3af04bd28f94584aa74e159861cf0acb.exe

Drops file in Windows directory 2 IoCs

Processes:

59d3f41859d239271e8f15cf8a26ba3e3af04bd28f94584aa74e159861cf0acb.exeDiskmedier4.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	59d3f41859d239271e8f15cf8a26ba3e3af04bd28f94584aa74e159861cf0acb.exe
File opened for modification	C:\Windows\win.ini	Diskmedier4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4880 schtasks.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

59d3f41859d239271e8f15cf8a26ba3e3af04bd28f94584aa74e159861cf0acb.exeDiskmedier4.exe

pid process

3568 59d3f41859d239271e8f15cf8a26ba3e3af04bd28f94584aa74e159861cf0acb.exe
1080 Diskmedier4.exe

pid	process
4880	schtasks.exe

pid	process
3568	59d3f41859d239271e8f15cf8a26ba3e3af04bd28f94584aa74e159861cf0acb.exe
1080	Diskmedier4.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

59d3f41859d239271e8f15cf8a26ba3e3af04bd28f94584aa74e159861cf0acb.exe

description	pid	process	target process
PID 3568 wrote to memory of 4880	3568	59d3f41859d239271e8f15cf8a26ba3e3af04bd28f94584aa74e159861cf0acb.exe	schtasks.exe
PID 3568 wrote to memory of 4880	3568	59d3f41859d239271e8f15cf8a26ba3e3af04bd28f94584aa74e159861cf0acb.exe	schtasks.exe
PID 3568 wrote to memory of 4880	3568	59d3f41859d239271e8f15cf8a26ba3e3af04bd28f94584aa74e159861cf0acb.exe	schtasks.exe
PID 3568 wrote to memory of 1040	3568	59d3f41859d239271e8f15cf8a26ba3e3af04bd28f94584aa74e159861cf0acb.exe	schtasks.exe
PID 3568 wrote to memory of 1040	3568	59d3f41859d239271e8f15cf8a26ba3e3af04bd28f94584aa74e159861cf0acb.exe	schtasks.exe
PID 3568 wrote to memory of 1040	3568	59d3f41859d239271e8f15cf8a26ba3e3af04bd28f94584aa74e159861cf0acb.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\59d3f41859d239271e8f15cf8a26ba3e3af04bd28f94584aa74e159861cf0acb.exe
"C:\Users\Admin\AppData\Local\Temp\59d3f41859d239271e8f15cf8a26ba3e3af04bd28f94584aa74e159861cf0acb.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3568

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN "Nonperversion" /TR "C:\Users\Admin\AppData\Roaming\Diskmedier4.exe"
2⤵
- Creates scheduled task(s)
PID:4880

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /run /tn "Nonperversion"
2⤵
PID:1040

C:\Users\Admin\AppData\Roaming\Diskmedier4.exe
C:\Users\Admin\AppData\Roaming\Diskmedier4.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Diskmedier4.exe

Filesize
488KB

MD5
47cfea561c3a736691d4b8021e161db9

SHA1
8c9f3033a9e87b4216547341a74355afc7185b52

SHA256
6f07468af24c14e11566b2c2adcd5edec6e343c25ea5dc5448edcd521cd3ad46

SHA512
bec5096c91599505e4fed6ab3c0617249cb11ea43a88fa7b6cf6f85290be4881cc696f7ec6cf5810cf42405ec2b3c826f85fc0acfcb9661d4f88f405bb26ca48

Download Submit
C:\Users\Admin\AppData\Roaming\Diskmedier4.exe

Filesize
488KB

MD5
47cfea561c3a736691d4b8021e161db9

SHA1
8c9f3033a9e87b4216547341a74355afc7185b52

SHA256
6f07468af24c14e11566b2c2adcd5edec6e343c25ea5dc5448edcd521cd3ad46

SHA512
bec5096c91599505e4fed6ab3c0617249cb11ea43a88fa7b6cf6f85290be4881cc696f7ec6cf5810cf42405ec2b3c826f85fc0acfcb9661d4f88f405bb26ca48

Download Submit
C:\Windows\win.ini

Filesize
132B

MD5
234a6c762b9601463e362fa58e2b30ea

SHA1
f33e3813919e6b16f6a893ddc03d959262a6a305

SHA256
a6f05138921facc2c229c216b448815252ef5e8461bc415f26befd222c5ebb8a

SHA512
3066882c0e2937b5872923ca262d56e56f63cbbffcf769d865e01398d3e3580dbbf02c18aeb6b3ebd59421657db0856ec62d7150afba138ea177ca86399acc27

Download Submit
memory/1040-135-0x0000000000000000-mapping.dmp

Download
memory/1080-142-0x0000000003010000-0x0000000003110000-memory.dmp

Filesize
1024KB

Download
memory/1080-143-0x0000000077A80000-0x0000000077C23000-memory.dmp

Filesize
1.6MB

Download
memory/1080-145-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1080-151-0x0000000075680000-0x00000000757DD000-memory.dmp

Filesize
1.4MB

Download
memory/1080-152-0x0000000003010000-0x0000000003110000-memory.dmp

Filesize
1024KB

Download
memory/1080-153-0x0000000077A80000-0x0000000077C23000-memory.dmp

Filesize
1.6MB

Download
memory/3568-136-0x0000000077A80000-0x0000000077C23000-memory.dmp

Filesize
1.6MB

Download
memory/3568-132-0x0000000003240000-0x0000000003340000-memory.dmp

Filesize
1024KB

Download
memory/3568-134-0x0000000077A80000-0x0000000077C23000-memory.dmp

Filesize
1.6MB

Download
memory/4880-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads