netwire | 022a25c3b9a1973f3bf01598cf22ae87640fa8d71c8564bda601c43249df09a9

General

Target

Contract Wipak Oy 2022.pdf.exe
Size

675KB
MD5

5d7895b3ede1833a79a5c4fc7dc0455c
SHA1

714ce92fce404b32345b06e1d0fbbfaff30eaa62
SHA256

7d43cddf5679f4233ebf701f89050ec267f892165a4c34084ad65963af7ebc36
SHA512

6f0a9c1cb2d74436ebde9b2c1068902bb9e0a943fc59f788f3c9e37e037b6dd9c0e5e86f2aa3d9c67e9740e7012f42c96d04ba0f2c3ac69a1c1c106db4fbe26d

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

37.0.14.206:3384

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
true
offline_keylogger
true
password
Password234
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 11 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1644-69-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1644-70-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1644-71-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1644-73-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1644-74-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1644-75-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1644-78-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1644-83-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1680-105-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1680-109-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1680-111-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

Host.exeHost.exe

pid process

1596 Host.exe
1680 Host.exe
Loads dropped DLL 2 IoCs

Processes:

Contract Wipak Oy 2022.pdf.exe

pid process

1644 Contract Wipak Oy 2022.pdf.exe
1644 Contract Wipak Oy 2022.pdf.exe

pid	process
1596	Host.exe
1680	Host.exe

pid	process
1644	Contract Wipak Oy 2022.pdf.exe
1644	Contract Wipak Oy 2022.pdf.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Contract Wipak Oy 2022.pdf.exeHost.exe

description	pid	process	target process
PID 760 set thread context of 1644	760	Contract Wipak Oy 2022.pdf.exe	Contract Wipak Oy 2022.pdf.exe
PID 1596 set thread context of 1680	1596	Host.exe	Host.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1736 schtasks.exe
560 schtasks.exe

pid	process
1736	schtasks.exe
560	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

Contract Wipak Oy 2022.pdf.exepowershell.exeHost.exepowershell.exe

pid	process
760	Contract Wipak Oy 2022.pdf.exe
760	Contract Wipak Oy 2022.pdf.exe
760	Contract Wipak Oy 2022.pdf.exe
1460	powershell.exe
1596	Host.exe
2016	powershell.exe
1596	Host.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Contract Wipak Oy 2022.pdf.exepowershell.exeHost.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	760	Contract Wipak Oy 2022.pdf.exe
Token: SeDebugPrivilege	1460	powershell.exe
Token: SeDebugPrivilege	1596	Host.exe
Token: SeDebugPrivilege	2016	powershell.exe

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

Contract Wipak Oy 2022.pdf.exeContract Wipak Oy 2022.pdf.exeHost.exe

description	pid	process	target process
PID 760 wrote to memory of 1460	760	Contract Wipak Oy 2022.pdf.exe	powershell.exe
PID 760 wrote to memory of 1460	760	Contract Wipak Oy 2022.pdf.exe	powershell.exe
PID 760 wrote to memory of 1460	760	Contract Wipak Oy 2022.pdf.exe	powershell.exe
PID 760 wrote to memory of 1460	760	Contract Wipak Oy 2022.pdf.exe	powershell.exe
PID 760 wrote to memory of 1736	760	Contract Wipak Oy 2022.pdf.exe	schtasks.exe
PID 760 wrote to memory of 1736	760	Contract Wipak Oy 2022.pdf.exe	schtasks.exe
PID 760 wrote to memory of 1736	760	Contract Wipak Oy 2022.pdf.exe	schtasks.exe
PID 760 wrote to memory of 1736	760	Contract Wipak Oy 2022.pdf.exe	schtasks.exe
PID 760 wrote to memory of 1768	760	Contract Wipak Oy 2022.pdf.exe	Contract Wipak Oy 2022.pdf.exe
PID 760 wrote to memory of 1768	760	Contract Wipak Oy 2022.pdf.exe	Contract Wipak Oy 2022.pdf.exe
PID 760 wrote to memory of 1768	760	Contract Wipak Oy 2022.pdf.exe	Contract Wipak Oy 2022.pdf.exe
PID 760 wrote to memory of 1768	760	Contract Wipak Oy 2022.pdf.exe	Contract Wipak Oy 2022.pdf.exe
PID 760 wrote to memory of 1644	760	Contract Wipak Oy 2022.pdf.exe	Contract Wipak Oy 2022.pdf.exe
PID 760 wrote to memory of 1644	760	Contract Wipak Oy 2022.pdf.exe	Contract Wipak Oy 2022.pdf.exe
PID 760 wrote to memory of 1644	760	Contract Wipak Oy 2022.pdf.exe	Contract Wipak Oy 2022.pdf.exe
PID 760 wrote to memory of 1644	760	Contract Wipak Oy 2022.pdf.exe	Contract Wipak Oy 2022.pdf.exe
PID 760 wrote to memory of 1644	760	Contract Wipak Oy 2022.pdf.exe	Contract Wipak Oy 2022.pdf.exe
PID 760 wrote to memory of 1644	760	Contract Wipak Oy 2022.pdf.exe	Contract Wipak Oy 2022.pdf.exe
PID 760 wrote to memory of 1644	760	Contract Wipak Oy 2022.pdf.exe	Contract Wipak Oy 2022.pdf.exe
PID 760 wrote to memory of 1644	760	Contract Wipak Oy 2022.pdf.exe	Contract Wipak Oy 2022.pdf.exe
PID 760 wrote to memory of 1644	760	Contract Wipak Oy 2022.pdf.exe	Contract Wipak Oy 2022.pdf.exe
PID 760 wrote to memory of 1644	760	Contract Wipak Oy 2022.pdf.exe	Contract Wipak Oy 2022.pdf.exe
PID 760 wrote to memory of 1644	760	Contract Wipak Oy 2022.pdf.exe	Contract Wipak Oy 2022.pdf.exe
PID 760 wrote to memory of 1644	760	Contract Wipak Oy 2022.pdf.exe	Contract Wipak Oy 2022.pdf.exe
PID 1644 wrote to memory of 1596	1644	Contract Wipak Oy 2022.pdf.exe	Host.exe
PID 1644 wrote to memory of 1596	1644	Contract Wipak Oy 2022.pdf.exe	Host.exe
PID 1644 wrote to memory of 1596	1644	Contract Wipak Oy 2022.pdf.exe	Host.exe
PID 1644 wrote to memory of 1596	1644	Contract Wipak Oy 2022.pdf.exe	Host.exe
PID 1596 wrote to memory of 2016	1596	Host.exe	powershell.exe
PID 1596 wrote to memory of 2016	1596	Host.exe	powershell.exe
PID 1596 wrote to memory of 2016	1596	Host.exe	powershell.exe
PID 1596 wrote to memory of 2016	1596	Host.exe	powershell.exe
PID 1596 wrote to memory of 560	1596	Host.exe	schtasks.exe
PID 1596 wrote to memory of 560	1596	Host.exe	schtasks.exe
PID 1596 wrote to memory of 560	1596	Host.exe	schtasks.exe
PID 1596 wrote to memory of 560	1596	Host.exe	schtasks.exe
PID 1596 wrote to memory of 1680	1596	Host.exe	Host.exe
PID 1596 wrote to memory of 1680	1596	Host.exe	Host.exe
PID 1596 wrote to memory of 1680	1596	Host.exe	Host.exe
PID 1596 wrote to memory of 1680	1596	Host.exe	Host.exe
PID 1596 wrote to memory of 1680	1596	Host.exe	Host.exe
PID 1596 wrote to memory of 1680	1596	Host.exe	Host.exe
PID 1596 wrote to memory of 1680	1596	Host.exe	Host.exe
PID 1596 wrote to memory of 1680	1596	Host.exe	Host.exe
PID 1596 wrote to memory of 1680	1596	Host.exe	Host.exe
PID 1596 wrote to memory of 1680	1596	Host.exe	Host.exe
PID 1596 wrote to memory of 1680	1596	Host.exe	Host.exe
PID 1596 wrote to memory of 1680	1596	Host.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\Contract Wipak Oy 2022.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Contract Wipak Oy 2022.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JzSLOgzqANjJNq.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1460

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JzSLOgzqANjJNq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCE0A.tmp"
2⤵
- Creates scheduled task(s)
PID:1736

C:\Users\Admin\AppData\Local\Temp\Contract Wipak Oy 2022.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Contract Wipak Oy 2022.pdf.exe"
2⤵
PID:1768

C:\Users\Admin\AppData\Local\Temp\Contract Wipak Oy 2022.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Contract Wipak Oy 2022.pdf.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JzSLOgzqANjJNq.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JzSLOgzqANjJNq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8C3A.tmp"
4⤵
- Creates scheduled task(s)
PID:560

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
4⤵
- Executes dropped EXE
PID:1680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8C3A.tmp

Filesize
1KB

MD5
a142d617100ecf0f4f9351e69c9b65d2

SHA1
4785f1f0bfbc59e70f5e4c1ad6b5528a3fd55fcd

SHA256
112fd13cd90b6839e0925210f2691316cfe76fa6bc0879b3516d5c0939d93f6b

SHA512
a288004e877caf4a0e06eb6a7c237fcc9ab8a51a68b3a5a428700b0819138065bb8f9a4162d83fb1e57398a9771aec1af0dc7ee9e8171d5fea41d0140e6da22c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCE0A.tmp

Filesize
1KB

MD5
a142d617100ecf0f4f9351e69c9b65d2

SHA1
4785f1f0bfbc59e70f5e4c1ad6b5528a3fd55fcd

SHA256
112fd13cd90b6839e0925210f2691316cfe76fa6bc0879b3516d5c0939d93f6b

SHA512
a288004e877caf4a0e06eb6a7c237fcc9ab8a51a68b3a5a428700b0819138065bb8f9a4162d83fb1e57398a9771aec1af0dc7ee9e8171d5fea41d0140e6da22c

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
675KB

MD5
5d7895b3ede1833a79a5c4fc7dc0455c

SHA1
714ce92fce404b32345b06e1d0fbbfaff30eaa62

SHA256
7d43cddf5679f4233ebf701f89050ec267f892165a4c34084ad65963af7ebc36

SHA512
6f0a9c1cb2d74436ebde9b2c1068902bb9e0a943fc59f788f3c9e37e037b6dd9c0e5e86f2aa3d9c67e9740e7012f42c96d04ba0f2c3ac69a1c1c106db4fbe26d

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
675KB

MD5
5d7895b3ede1833a79a5c4fc7dc0455c

SHA1
714ce92fce404b32345b06e1d0fbbfaff30eaa62

SHA256
7d43cddf5679f4233ebf701f89050ec267f892165a4c34084ad65963af7ebc36

SHA512
6f0a9c1cb2d74436ebde9b2c1068902bb9e0a943fc59f788f3c9e37e037b6dd9c0e5e86f2aa3d9c67e9740e7012f42c96d04ba0f2c3ac69a1c1c106db4fbe26d

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
675KB

MD5
5d7895b3ede1833a79a5c4fc7dc0455c

SHA1
714ce92fce404b32345b06e1d0fbbfaff30eaa62

SHA256
7d43cddf5679f4233ebf701f89050ec267f892165a4c34084ad65963af7ebc36

SHA512
6f0a9c1cb2d74436ebde9b2c1068902bb9e0a943fc59f788f3c9e37e037b6dd9c0e5e86f2aa3d9c67e9740e7012f42c96d04ba0f2c3ac69a1c1c106db4fbe26d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
ad4d6038080b6088519a7b7b6032d038

SHA1
0e92744ec9bd47d3be4a4d9a79b54e476842e53b

SHA256
0c6dc0a4c47c50801dce9aff2b6814ef307ef917ee70c5ca339a1f6a3b99e077

SHA512
7815a29e77a26740af5d2c4295aab7687bc34a5ba5314b18b8145f33ab9bb48da75ef2e80a719a416aca57f03194bb9333ec719b0e1b3c982b61c536b1eb47bb

Download Submit
\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
675KB

MD5
5d7895b3ede1833a79a5c4fc7dc0455c

SHA1
714ce92fce404b32345b06e1d0fbbfaff30eaa62

SHA256
7d43cddf5679f4233ebf701f89050ec267f892165a4c34084ad65963af7ebc36

SHA512
6f0a9c1cb2d74436ebde9b2c1068902bb9e0a943fc59f788f3c9e37e037b6dd9c0e5e86f2aa3d9c67e9740e7012f42c96d04ba0f2c3ac69a1c1c106db4fbe26d

Download Submit
\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
675KB

MD5
5d7895b3ede1833a79a5c4fc7dc0455c

SHA1
714ce92fce404b32345b06e1d0fbbfaff30eaa62

SHA256
7d43cddf5679f4233ebf701f89050ec267f892165a4c34084ad65963af7ebc36

SHA512
6f0a9c1cb2d74436ebde9b2c1068902bb9e0a943fc59f788f3c9e37e037b6dd9c0e5e86f2aa3d9c67e9740e7012f42c96d04ba0f2c3ac69a1c1c106db4fbe26d

Download Submit
memory/560-90-0x0000000000000000-mapping.dmp

Download
memory/760-57-0x0000000000500000-0x000000000050A000-memory.dmp

Filesize
40KB

Download
memory/760-54-0x00000000008B0000-0x0000000000960000-memory.dmp

Filesize
704KB

Download
memory/760-63-0x0000000005680000-0x00000000056E4000-memory.dmp

Filesize
400KB

Download
memory/760-58-0x00000000055E0000-0x000000000567A000-memory.dmp

Filesize
616KB

Download
memory/760-56-0x00000000004E0000-0x00000000004FE000-memory.dmp

Filesize
120KB

Download
memory/760-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1460-59-0x0000000000000000-mapping.dmp

Download
memory/1460-87-0x000000006F180000-0x000000006F72B000-memory.dmp

Filesize
5.7MB

Download
memory/1460-88-0x000000006F180000-0x000000006F72B000-memory.dmp

Filesize
5.7MB

Download
memory/1596-85-0x0000000000CB0000-0x0000000000D60000-memory.dmp

Filesize
704KB

Download
memory/1596-81-0x0000000000000000-mapping.dmp

Download
memory/1644-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1644-69-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1644-75-0x000000000040242D-mapping.dmp

Download
memory/1644-83-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1644-74-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1644-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1644-71-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1644-70-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1644-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1644-78-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1644-67-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1680-105-0x000000000040242D-mapping.dmp

Download
memory/1680-109-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1680-111-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1736-60-0x0000000000000000-mapping.dmp

Download
memory/2016-89-0x0000000000000000-mapping.dmp

Download
memory/2016-110-0x0000000073BB0000-0x000000007415B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads