netwire | 9cab0f61512b3ae9466db036a7a3dfc6b6deaa3756f9ba72fa7095a0c8f82328

General

Target

9cab0f61512b3ae9466db036a7a3dfc6b6deaa3756f9ba72fa7095a0c8f82328.exe
Size

1.1MB
MD5

061dc947f87b44a8e531a4c6038ce9d6
SHA1

0892589b478df6ffba31e3d021e2b8c55dd81651
SHA256

9cab0f61512b3ae9466db036a7a3dfc6b6deaa3756f9ba72fa7095a0c8f82328
SHA512

1bd471f606bdabf0b3f4af1aca75a22c565cf4043b410433643f7d4a6665af870159beb23428f148a4b27d2c5761f5d415ce533f2af96081d9147196f3314a2b

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3984-137-0x0000000000400000-0x0000000000425000-memory.dmp	netwire
behavioral2/memory/3984-139-0x0000000000400000-0x0000000000425000-memory.dmp	netwire
behavioral2/memory/3984-140-0x0000000000400000-0x0000000000425000-memory.dmp	netwire
behavioral2/memory/3984-141-0x0000000000400000-0x0000000000425000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

xxxxxx.exe

pid process

4272 xxxxxx.exe

pid	process
4272	xxxxxx.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9cab0f61512b3ae9466db036a7a3dfc6b6deaa3756f9ba72fa7095a0c8f82328.exexxxxxx.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9cab0f61512b3ae9466db036a7a3dfc6b6deaa3756f9ba72fa7095a0c8f82328.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OKFPNP = "C:\\Users\\Admin\\AppData\\Local\\OKFPNP\\OKFPNPRE.vbs"	xxxxxx.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	9cab0f61512b3ae9466db036a7a3dfc6b6deaa3756f9ba72fa7095a0c8f82328.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

xxxxxx.exe

description pid process target process

PID 4272 set thread context of 3984 4272 xxxxxx.exe TapiUnattend.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

xxxxxx.exe

pid process

4272 xxxxxx.exe
4272 xxxxxx.exe
4272 xxxxxx.exe
4272 xxxxxx.exe

description	pid	process	target process
PID 4272 set thread context of 3984	4272	xxxxxx.exe	TapiUnattend.exe

pid	process
4272	xxxxxx.exe
4272	xxxxxx.exe
4272	xxxxxx.exe
4272	xxxxxx.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

9cab0f61512b3ae9466db036a7a3dfc6b6deaa3756f9ba72fa7095a0c8f82328.exexxxxxx.exe

description	pid	process	target process
PID 4964 wrote to memory of 4272	4964	9cab0f61512b3ae9466db036a7a3dfc6b6deaa3756f9ba72fa7095a0c8f82328.exe	xxxxxx.exe
PID 4964 wrote to memory of 4272	4964	9cab0f61512b3ae9466db036a7a3dfc6b6deaa3756f9ba72fa7095a0c8f82328.exe	xxxxxx.exe
PID 4964 wrote to memory of 4272	4964	9cab0f61512b3ae9466db036a7a3dfc6b6deaa3756f9ba72fa7095a0c8f82328.exe	xxxxxx.exe
PID 4272 wrote to memory of 3984	4272	xxxxxx.exe	TapiUnattend.exe
PID 4272 wrote to memory of 3984	4272	xxxxxx.exe	TapiUnattend.exe
PID 4272 wrote to memory of 3984	4272	xxxxxx.exe	TapiUnattend.exe
PID 4272 wrote to memory of 3984	4272	xxxxxx.exe	TapiUnattend.exe
PID 4272 wrote to memory of 3984	4272	xxxxxx.exe	TapiUnattend.exe

C:\Users\Admin\AppData\Local\Temp\9cab0f61512b3ae9466db036a7a3dfc6b6deaa3756f9ba72fa7095a0c8f82328.exe
"C:\Users\Admin\AppData\Local\Temp\9cab0f61512b3ae9466db036a7a3dfc6b6deaa3756f9ba72fa7095a0c8f82328.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4964

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xxxxxx.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xxxxxx.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4272

C:\Windows\SysWOW64\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
3⤵
PID:3984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xxx.bmp

Filesize
551KB

MD5
29b5bdc4be65fd95d737bb487d3103f1

SHA1
b96a29beeecd961767e9abe347a508cd474e2e01

SHA256
362175b76e4911263aefa81858b0c3b4e01bf992d7a08b4cb1b160bc6d00db0c

SHA512
4070c975db4fff163bf3955776b3f1b00bd5cb7b9451ee0ba299ed1af5f85d9e756dd41c7a7425985543c97f49cb419ece63861597df33de6e7d27ee4f218924

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xxxxxx.exe

Filesize
759KB

MD5
88cec867d63b7562b7f0dd495c1e2aeb

SHA1
29c6dfe02530a851109329435b06ab1d14aa916b

SHA256
62f690c7b1df8004432f31594b0b7e69eb19cbe4c46a8505eeb8e7bd9fa3553f

SHA512
83ad97065c3a2f4ca4452c0e7906680455cd46769579bf907d0c8de32bbaf84136081ce6d616ff71ea9caee8171ea6e33211b096e3cd31a50e009f742f4b3352

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xxxxxx.exe

Filesize
759KB

MD5
88cec867d63b7562b7f0dd495c1e2aeb

SHA1
29c6dfe02530a851109329435b06ab1d14aa916b

SHA256
62f690c7b1df8004432f31594b0b7e69eb19cbe4c46a8505eeb8e7bd9fa3553f

SHA512
83ad97065c3a2f4ca4452c0e7906680455cd46769579bf907d0c8de32bbaf84136081ce6d616ff71ea9caee8171ea6e33211b096e3cd31a50e009f742f4b3352

Download Submit
memory/3984-136-0x0000000000000000-mapping.dmp

Download
memory/3984-137-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3984-139-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3984-140-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3984-141-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4272-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads