netwire | 7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37

Analysis

max time kernel
86s
max time network
48s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
25-07-2022 00:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe
Size

292KB
MD5

620399ca3fa933940813332a6aa2d003
SHA1

838b5bf26b4b18bf7bf531164ad659771bcdb136
SHA256

7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37
SHA512

81c620b98ab7c179f5373d335472936209215133df9655166d276798069b0341fb51d59f7e2860839f92b67aeb9ed28bd019e915f0d533707ec6ebe8edd8c3f5

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/816-106-0x0000000000400000-0x000000000044E000-memory.dmp	netwire
behavioral1/memory/816-107-0x0000000000400000-0x0000000000425000-memory.dmp	netwire
behavioral1/memory/816-116-0x0000000000400000-0x000000000044E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

Form1trans.exeForm1trans.exe

pid process

900 Form1trans.exe
816 Form1trans.exe

pid	process
900	Form1trans.exe
816	Form1trans.exe

Loads dropped DLL 2 IoCs

Processes:

7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe

pid	process
2016	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe
2016	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Form1trans.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	Form1trans.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Form1Tric5 = "wscript \"C:\\Users\\Admin\\Form1screw\\Form1trans.vbs\""	Form1trans.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exeForm1trans.exe

description	pid	process	target process
PID 1224 set thread context of 2016	1224	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe
PID 900 set thread context of 816	900	Form1trans.exe	Form1trans.exe

Drops file in Windows directory 4 IoCs

Processes:

7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exeForm1trans.exeForm1trans.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe
File opened for modification	C:\Windows\win.ini	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe
File opened for modification	C:\Windows\win.ini	Form1trans.exe
File opened for modification	C:\Windows\win.ini	Form1trans.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exeForm1trans.exeForm1trans.exe

pid	process
1224	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe
2016	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe
900	Form1trans.exe
816	Form1trans.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exeForm1trans.exe

description	pid	process	target process
PID 1224 wrote to memory of 2016	1224	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe
PID 1224 wrote to memory of 2016	1224	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe
PID 1224 wrote to memory of 2016	1224	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe
PID 1224 wrote to memory of 2016	1224	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe
PID 2016 wrote to memory of 900	2016	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe	Form1trans.exe
PID 2016 wrote to memory of 900	2016	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe	Form1trans.exe
PID 2016 wrote to memory of 900	2016	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe	Form1trans.exe
PID 2016 wrote to memory of 900	2016	7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe	Form1trans.exe
PID 900 wrote to memory of 816	900	Form1trans.exe	Form1trans.exe
PID 900 wrote to memory of 816	900	Form1trans.exe	Form1trans.exe
PID 900 wrote to memory of 816	900	Form1trans.exe	Form1trans.exe
PID 900 wrote to memory of 816	900	Form1trans.exe	Form1trans.exe

C:\Users\Admin\AppData\Local\Temp\7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe
"C:\Users\Admin\AppData\Local\Temp\7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224

C:\Users\Admin\AppData\Local\Temp\7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe
"C:\Users\Admin\AppData\Local\Temp\7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37.exe"
2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016

C:\Users\Admin\Form1screw\Form1trans.exe
"C:\Users\Admin\Form1screw\Form1trans.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900

C:\Users\Admin\Form1screw\Form1trans.exe
"C:\Users\Admin\Form1screw\Form1trans.exe"
4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Form1screw\Form1trans.exe

Filesize
292KB

MD5
620399ca3fa933940813332a6aa2d003

SHA1
838b5bf26b4b18bf7bf531164ad659771bcdb136

SHA256
7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37

SHA512
81c620b98ab7c179f5373d335472936209215133df9655166d276798069b0341fb51d59f7e2860839f92b67aeb9ed28bd019e915f0d533707ec6ebe8edd8c3f5

Download Submit
C:\Users\Admin\Form1screw\Form1trans.exe

Filesize
292KB

MD5
620399ca3fa933940813332a6aa2d003

SHA1
838b5bf26b4b18bf7bf531164ad659771bcdb136

SHA256
7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37

SHA512
81c620b98ab7c179f5373d335472936209215133df9655166d276798069b0341fb51d59f7e2860839f92b67aeb9ed28bd019e915f0d533707ec6ebe8edd8c3f5

Download Submit
C:\Users\Admin\Form1screw\Form1trans.exe

Filesize
292KB

MD5
620399ca3fa933940813332a6aa2d003

SHA1
838b5bf26b4b18bf7bf531164ad659771bcdb136

SHA256
7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37

SHA512
81c620b98ab7c179f5373d335472936209215133df9655166d276798069b0341fb51d59f7e2860839f92b67aeb9ed28bd019e915f0d533707ec6ebe8edd8c3f5

Download Submit
C:\Windows\win.ini

Filesize
509B

MD5
d2a2412bddba16d60ec63bd9550d933f

SHA1
deb3d3bdc9055f0b4909b31d3048446848fae0e1

SHA256
79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a

SHA512
8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

Download Submit
C:\Windows\win.ini

Filesize
509B

MD5
d2a2412bddba16d60ec63bd9550d933f

SHA1
deb3d3bdc9055f0b4909b31d3048446848fae0e1

SHA256
79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a

SHA512
8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

Download Submit
C:\Windows\win.ini

Filesize
509B

MD5
d2a2412bddba16d60ec63bd9550d933f

SHA1
deb3d3bdc9055f0b4909b31d3048446848fae0e1

SHA256
79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a

SHA512
8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

Download Submit
\Users\Admin\Form1screw\Form1trans.exe

Filesize
292KB

MD5
620399ca3fa933940813332a6aa2d003

SHA1
838b5bf26b4b18bf7bf531164ad659771bcdb136

SHA256
7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37

SHA512
81c620b98ab7c179f5373d335472936209215133df9655166d276798069b0341fb51d59f7e2860839f92b67aeb9ed28bd019e915f0d533707ec6ebe8edd8c3f5

Download Submit
\Users\Admin\Form1screw\Form1trans.exe

Filesize
292KB

MD5
620399ca3fa933940813332a6aa2d003

SHA1
838b5bf26b4b18bf7bf531164ad659771bcdb136

SHA256
7668b4f124d00c48ac9c4ecad5d14d40d4c0bc71eb98979a3ca0adb1c276ed37

SHA512
81c620b98ab7c179f5373d335472936209215133df9655166d276798069b0341fb51d59f7e2860839f92b67aeb9ed28bd019e915f0d533707ec6ebe8edd8c3f5

Download Submit
memory/816-112-0x0000000077A40000-0x0000000077BE9000-memory.dmp

Filesize
1.7MB

Download
memory/816-106-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/816-107-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/816-116-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/816-117-0x00000000003F0000-0x00000000003F3000-memory.dmp

Filesize
12KB

Download
memory/816-97-0x0000000000000000-mapping.dmp

Download
memory/900-108-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/900-103-0x0000000000530000-0x0000000000533000-memory.dmp

Filesize
12KB

Download
memory/900-104-0x0000000077A40000-0x0000000077BE9000-memory.dmp

Filesize
1.7MB

Download
memory/900-105-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/900-110-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/900-88-0x0000000000000000-mapping.dmp

Download
memory/1224-70-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/1224-73-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/1224-81-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/1224-79-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/1224-82-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/1224-78-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/1224-85-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/1224-77-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/1224-76-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/1224-75-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/1224-60-0x00000000003F0000-0x00000000003F3000-memory.dmp

Filesize
12KB

Download
memory/1224-74-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/1224-61-0x0000000077A40000-0x0000000077BE9000-memory.dmp

Filesize
1.7MB

Download
memory/1224-80-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/1224-72-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/1224-71-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/1224-56-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/1224-69-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/1224-68-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/1224-67-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/1224-66-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/1224-65-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/1224-64-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/1224-63-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/1224-62-0x0000000077C20000-0x0000000077DA0000-memory.dmp

Filesize
1.5MB

Download
memory/2016-93-0x0000000077C30000-0x0000000077D06000-memory.dmp

Filesize
856KB

Download
memory/2016-91-0x0000000077A40000-0x0000000077BE9000-memory.dmp

Filesize
1.7MB

Download
memory/2016-57-0x0000000000000000-mapping.dmp

Download