netwire | 7d43cddf5679f4233ebf701f89050ec267f892165a4c34084ad65963af7ebc36

General

Target

PO-92059.doc.exe
Size

675KB
MD5

5d7895b3ede1833a79a5c4fc7dc0455c
SHA1

714ce92fce404b32345b06e1d0fbbfaff30eaa62
SHA256

7d43cddf5679f4233ebf701f89050ec267f892165a4c34084ad65963af7ebc36
SHA512

6f0a9c1cb2d74436ebde9b2c1068902bb9e0a943fc59f788f3c9e37e037b6dd9c0e5e86f2aa3d9c67e9740e7012f42c96d04ba0f2c3ac69a1c1c106db4fbe26d

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

37.0.14.206:3384

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
true
offline_keylogger
true
password
Password234
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 11 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1716-69-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1716-70-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1716-71-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1716-73-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1716-74-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1716-75-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1716-78-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1716-83-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1724-105-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1724-109-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1724-112-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

Host.exeHost.exe

pid process

1656 Host.exe
1724 Host.exe
Loads dropped DLL 2 IoCs

Processes:

PO-92059.doc.exe

pid process

1716 PO-92059.doc.exe
1716 PO-92059.doc.exe

pid	process
1656	Host.exe
1724	Host.exe

pid	process
1716	PO-92059.doc.exe
1716	PO-92059.doc.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

PO-92059.doc.exeHost.exe

description	pid	process	target process
PID 996 set thread context of 1716	996	PO-92059.doc.exe	PO-92059.doc.exe
PID 1656 set thread context of 1724	1656	Host.exe	Host.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

944 schtasks.exe
788 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

PO-92059.doc.exepowershell.exeHost.exepowershell.exe

pid process

996 PO-92059.doc.exe
996 PO-92059.doc.exe
848 powershell.exe
1656 Host.exe
308 powershell.exe
1656 Host.exe

pid	process
944	schtasks.exe
788	schtasks.exe

pid	process
996	PO-92059.doc.exe
996	PO-92059.doc.exe
848	powershell.exe
1656	Host.exe
308	powershell.exe
1656	Host.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

PO-92059.doc.exepowershell.exeHost.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	996	PO-92059.doc.exe
Token: SeDebugPrivilege	848	powershell.exe
Token: SeDebugPrivilege	1656	Host.exe
Token: SeDebugPrivilege	308	powershell.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

PO-92059.doc.exePO-92059.doc.exeHost.exe

description	pid	process	target process
PID 996 wrote to memory of 848	996	PO-92059.doc.exe	powershell.exe
PID 996 wrote to memory of 848	996	PO-92059.doc.exe	powershell.exe
PID 996 wrote to memory of 848	996	PO-92059.doc.exe	powershell.exe
PID 996 wrote to memory of 848	996	PO-92059.doc.exe	powershell.exe
PID 996 wrote to memory of 944	996	PO-92059.doc.exe	schtasks.exe
PID 996 wrote to memory of 944	996	PO-92059.doc.exe	schtasks.exe
PID 996 wrote to memory of 944	996	PO-92059.doc.exe	schtasks.exe
PID 996 wrote to memory of 944	996	PO-92059.doc.exe	schtasks.exe
PID 996 wrote to memory of 1716	996	PO-92059.doc.exe	PO-92059.doc.exe
PID 996 wrote to memory of 1716	996	PO-92059.doc.exe	PO-92059.doc.exe
PID 996 wrote to memory of 1716	996	PO-92059.doc.exe	PO-92059.doc.exe
PID 996 wrote to memory of 1716	996	PO-92059.doc.exe	PO-92059.doc.exe
PID 996 wrote to memory of 1716	996	PO-92059.doc.exe	PO-92059.doc.exe
PID 996 wrote to memory of 1716	996	PO-92059.doc.exe	PO-92059.doc.exe
PID 996 wrote to memory of 1716	996	PO-92059.doc.exe	PO-92059.doc.exe
PID 996 wrote to memory of 1716	996	PO-92059.doc.exe	PO-92059.doc.exe
PID 996 wrote to memory of 1716	996	PO-92059.doc.exe	PO-92059.doc.exe
PID 996 wrote to memory of 1716	996	PO-92059.doc.exe	PO-92059.doc.exe
PID 996 wrote to memory of 1716	996	PO-92059.doc.exe	PO-92059.doc.exe
PID 996 wrote to memory of 1716	996	PO-92059.doc.exe	PO-92059.doc.exe
PID 1716 wrote to memory of 1656	1716	PO-92059.doc.exe	Host.exe
PID 1716 wrote to memory of 1656	1716	PO-92059.doc.exe	Host.exe
PID 1716 wrote to memory of 1656	1716	PO-92059.doc.exe	Host.exe
PID 1716 wrote to memory of 1656	1716	PO-92059.doc.exe	Host.exe
PID 1656 wrote to memory of 308	1656	Host.exe	powershell.exe
PID 1656 wrote to memory of 308	1656	Host.exe	powershell.exe
PID 1656 wrote to memory of 308	1656	Host.exe	powershell.exe
PID 1656 wrote to memory of 308	1656	Host.exe	powershell.exe
PID 1656 wrote to memory of 788	1656	Host.exe	schtasks.exe
PID 1656 wrote to memory of 788	1656	Host.exe	schtasks.exe
PID 1656 wrote to memory of 788	1656	Host.exe	schtasks.exe
PID 1656 wrote to memory of 788	1656	Host.exe	schtasks.exe
PID 1656 wrote to memory of 1724	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 1724	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 1724	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 1724	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 1724	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 1724	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 1724	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 1724	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 1724	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 1724	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 1724	1656	Host.exe	Host.exe
PID 1656 wrote to memory of 1724	1656	Host.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\PO-92059.doc.exe
"C:\Users\Admin\AppData\Local\Temp\PO-92059.doc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JzSLOgzqANjJNq.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:848

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JzSLOgzqANjJNq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2F6B.tmp"
2⤵
- Creates scheduled task(s)
PID:944

C:\Users\Admin\AppData\Local\Temp\PO-92059.doc.exe
"C:\Users\Admin\AppData\Local\Temp\PO-92059.doc.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1716

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JzSLOgzqANjJNq.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:308

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JzSLOgzqANjJNq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEC43.tmp"
4⤵
- Creates scheduled task(s)
PID:788

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
4⤵
- Executes dropped EXE
PID:1724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2F6B.tmp

Filesize
1KB

MD5
0913f416ed9b169e9c40c982e0bf7f47

SHA1
df26426c4793001d7469616bc7ff266cd48407ed

SHA256
76c1f984e35bc4dc5b92d073cfc104d9b9d147cf30244813a79fe3f775ee6a50

SHA512
c8b1f77604a0a71d702f0319fc810f315951c17dbd15696dfd7c6bbc533a9475ec1ffe0fd5eec76142e971cb9042dca71d407260941202f0998e9d835f35da51

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEC43.tmp

Filesize
1KB

MD5
0913f416ed9b169e9c40c982e0bf7f47

SHA1
df26426c4793001d7469616bc7ff266cd48407ed

SHA256
76c1f984e35bc4dc5b92d073cfc104d9b9d147cf30244813a79fe3f775ee6a50

SHA512
c8b1f77604a0a71d702f0319fc810f315951c17dbd15696dfd7c6bbc533a9475ec1ffe0fd5eec76142e971cb9042dca71d407260941202f0998e9d835f35da51

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
675KB

MD5
5d7895b3ede1833a79a5c4fc7dc0455c

SHA1
714ce92fce404b32345b06e1d0fbbfaff30eaa62

SHA256
7d43cddf5679f4233ebf701f89050ec267f892165a4c34084ad65963af7ebc36

SHA512
6f0a9c1cb2d74436ebde9b2c1068902bb9e0a943fc59f788f3c9e37e037b6dd9c0e5e86f2aa3d9c67e9740e7012f42c96d04ba0f2c3ac69a1c1c106db4fbe26d

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
675KB

MD5
5d7895b3ede1833a79a5c4fc7dc0455c

SHA1
714ce92fce404b32345b06e1d0fbbfaff30eaa62

SHA256
7d43cddf5679f4233ebf701f89050ec267f892165a4c34084ad65963af7ebc36

SHA512
6f0a9c1cb2d74436ebde9b2c1068902bb9e0a943fc59f788f3c9e37e037b6dd9c0e5e86f2aa3d9c67e9740e7012f42c96d04ba0f2c3ac69a1c1c106db4fbe26d

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
675KB

MD5
5d7895b3ede1833a79a5c4fc7dc0455c

SHA1
714ce92fce404b32345b06e1d0fbbfaff30eaa62

SHA256
7d43cddf5679f4233ebf701f89050ec267f892165a4c34084ad65963af7ebc36

SHA512
6f0a9c1cb2d74436ebde9b2c1068902bb9e0a943fc59f788f3c9e37e037b6dd9c0e5e86f2aa3d9c67e9740e7012f42c96d04ba0f2c3ac69a1c1c106db4fbe26d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
3e78135d75e18f3b9b44b191fe926c0a

SHA1
b6fb68533fe0fd5b277d8719156f1b960619dc2b

SHA256
cd18c1b688088afdcc7606d57a8f76b9e905f42039bf4949b71ca01beb35e6bb

SHA512
b72fa053c0aff6165506dcea3e3425a0af47b9b824d3cf6bed3dc0136068efb1ce7f6390f9fc1f00d0c819a91ef7b330dfe130f82afd4c2355763c3f463fa19a

Download Submit
\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
675KB

MD5
5d7895b3ede1833a79a5c4fc7dc0455c

SHA1
714ce92fce404b32345b06e1d0fbbfaff30eaa62

SHA256
7d43cddf5679f4233ebf701f89050ec267f892165a4c34084ad65963af7ebc36

SHA512
6f0a9c1cb2d74436ebde9b2c1068902bb9e0a943fc59f788f3c9e37e037b6dd9c0e5e86f2aa3d9c67e9740e7012f42c96d04ba0f2c3ac69a1c1c106db4fbe26d

Download Submit
\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
675KB

MD5
5d7895b3ede1833a79a5c4fc7dc0455c

SHA1
714ce92fce404b32345b06e1d0fbbfaff30eaa62

SHA256
7d43cddf5679f4233ebf701f89050ec267f892165a4c34084ad65963af7ebc36

SHA512
6f0a9c1cb2d74436ebde9b2c1068902bb9e0a943fc59f788f3c9e37e037b6dd9c0e5e86f2aa3d9c67e9740e7012f42c96d04ba0f2c3ac69a1c1c106db4fbe26d

Download Submit
memory/308-89-0x0000000000000000-mapping.dmp

Download
memory/308-111-0x000000006F2B0000-0x000000006F85B000-memory.dmp

Filesize
5.7MB

Download
memory/308-110-0x000000006F2B0000-0x000000006F85B000-memory.dmp

Filesize
5.7MB

Download
memory/788-90-0x0000000000000000-mapping.dmp

Download
memory/848-87-0x000000006EAE0000-0x000000006F08B000-memory.dmp

Filesize
5.7MB

Download
memory/848-59-0x0000000000000000-mapping.dmp

Download
memory/848-88-0x000000006EAE0000-0x000000006F08B000-memory.dmp

Filesize
5.7MB

Download
memory/944-60-0x0000000000000000-mapping.dmp

Download
memory/996-54-0x0000000000F60000-0x0000000001010000-memory.dmp

Filesize
704KB

Download
memory/996-63-0x0000000005850000-0x00000000058B4000-memory.dmp

Filesize
400KB

Download
memory/996-58-0x0000000005560000-0x00000000055FA000-memory.dmp

Filesize
616KB

Download
memory/996-57-0x0000000000640000-0x000000000064A000-memory.dmp

Filesize
40KB

Download
memory/996-56-0x0000000000520000-0x000000000053E000-memory.dmp

Filesize
120KB

Download
memory/996-55-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/1656-81-0x0000000000000000-mapping.dmp

Download
memory/1656-85-0x0000000000FD0000-0x0000000001080000-memory.dmp

Filesize
704KB

Download
memory/1716-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1716-70-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1716-78-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1716-75-0x000000000040242D-mapping.dmp

Download
memory/1716-74-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1716-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1716-71-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1716-83-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1716-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1716-69-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1716-67-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1724-109-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1724-105-0x000000000040242D-mapping.dmp

Download
memory/1724-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads