netwire | fa7af6b88b54a5210f0ce1e5415024049ce296a6736cfdbfe6364b548f16b2d5

General

Target

PAYMENT.EXE.exe
Size

730KB
MD5

0f7acac42bf200953c39a59dc526abf4
SHA1

18e98f49b44046fed0ae7ee23d29653d6f40f09e
SHA256

fa7af6b88b54a5210f0ce1e5415024049ce296a6736cfdbfe6364b548f16b2d5
SHA512

6eefebcd507117f412ea7d04ff63ace99ceec1b5c92a80cd5cac0975bc3fa266def09fa27cbd7cff77714cc5316acb05b46f0e99f40d6cdcbf73532c7968245c

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

37.0.14.199:3374

37.0.14.199:3377

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
lovemoney12
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1324-71-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1324-72-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1324-73-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1324-75-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1324-77-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1324-76-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1324-81-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1324-82-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

PAYMENT.EXE.exe

description pid process target process

PID 1900 set thread context of 1324 1900 PAYMENT.EXE.exe PAYMENT.EXE.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

844 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

PAYMENT.EXE.exepowershell.exe

pid process

1900 PAYMENT.EXE.exe
1900 PAYMENT.EXE.exe
1752 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PAYMENT.EXE.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1900 PAYMENT.EXE.exe
Token: SeDebugPrivilege 1752 powershell.exe

description	pid	process	target process
PID 1900 set thread context of 1324	1900	PAYMENT.EXE.exe	PAYMENT.EXE.exe

pid	process
844	schtasks.exe

pid	process
1900	PAYMENT.EXE.exe
1900	PAYMENT.EXE.exe
1752	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1900	PAYMENT.EXE.exe
Token: SeDebugPrivilege	1752	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

PAYMENT.EXE.exe

description	pid	process	target process
PID 1900 wrote to memory of 1752	1900	PAYMENT.EXE.exe	powershell.exe
PID 1900 wrote to memory of 1752	1900	PAYMENT.EXE.exe	powershell.exe
PID 1900 wrote to memory of 1752	1900	PAYMENT.EXE.exe	powershell.exe
PID 1900 wrote to memory of 1752	1900	PAYMENT.EXE.exe	powershell.exe
PID 1900 wrote to memory of 844	1900	PAYMENT.EXE.exe	schtasks.exe
PID 1900 wrote to memory of 844	1900	PAYMENT.EXE.exe	schtasks.exe
PID 1900 wrote to memory of 844	1900	PAYMENT.EXE.exe	schtasks.exe
PID 1900 wrote to memory of 844	1900	PAYMENT.EXE.exe	schtasks.exe
PID 1900 wrote to memory of 1324	1900	PAYMENT.EXE.exe	PAYMENT.EXE.exe
PID 1900 wrote to memory of 1324	1900	PAYMENT.EXE.exe	PAYMENT.EXE.exe
PID 1900 wrote to memory of 1324	1900	PAYMENT.EXE.exe	PAYMENT.EXE.exe
PID 1900 wrote to memory of 1324	1900	PAYMENT.EXE.exe	PAYMENT.EXE.exe
PID 1900 wrote to memory of 1324	1900	PAYMENT.EXE.exe	PAYMENT.EXE.exe
PID 1900 wrote to memory of 1324	1900	PAYMENT.EXE.exe	PAYMENT.EXE.exe
PID 1900 wrote to memory of 1324	1900	PAYMENT.EXE.exe	PAYMENT.EXE.exe
PID 1900 wrote to memory of 1324	1900	PAYMENT.EXE.exe	PAYMENT.EXE.exe
PID 1900 wrote to memory of 1324	1900	PAYMENT.EXE.exe	PAYMENT.EXE.exe
PID 1900 wrote to memory of 1324	1900	PAYMENT.EXE.exe	PAYMENT.EXE.exe
PID 1900 wrote to memory of 1324	1900	PAYMENT.EXE.exe	PAYMENT.EXE.exe
PID 1900 wrote to memory of 1324	1900	PAYMENT.EXE.exe	PAYMENT.EXE.exe

C:\Users\Admin\AppData\Local\Temp\PAYMENT.EXE.exe
"C:\Users\Admin\AppData\Local\Temp\PAYMENT.EXE.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OiuzAFiUPZCIHZ.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1752

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OiuzAFiUPZCIHZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE541.tmp"
2⤵
- Creates scheduled task(s)
PID:844

C:\Users\Admin\AppData\Local\Temp\PAYMENT.EXE.exe
"C:\Users\Admin\AppData\Local\Temp\PAYMENT.EXE.exe"
2⤵
PID:1324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE541.tmp

Filesize
1KB

MD5
c938ae262bbc08592750195d25e84aa1

SHA1
2cd7bd88d5e067684d64ca4119cd49c7ec0e577e

SHA256
d05ed99c90c81be1acc4d3cdbc92909ee6a342c70084cc425d63dd3c68dfca6c

SHA512
971e5702aff59dc355ef599c3efdcb7e3e21e02e51773ef3fce02abe973c2793c9f874c410f172dc83e0cd0c98e6aafa5d78f8b1cbdf9df4bb8ca7a3e4c31d3c

Download Submit
memory/844-62-0x0000000000000000-mapping.dmp

Download
memory/1324-77-0x000000000040242D-mapping.dmp

Download
memory/1324-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1324-69-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1324-67-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1324-82-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1324-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1324-76-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1324-71-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1324-66-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1324-75-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1324-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1752-61-0x0000000000000000-mapping.dmp

Download
memory/1752-83-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download
memory/1900-58-0x0000000004E65000-0x0000000004E76000-memory.dmp

Filesize
68KB

Download
memory/1900-65-0x0000000004E10000-0x0000000004E40000-memory.dmp

Filesize
192KB

Download
memory/1900-57-0x0000000000AB0000-0x0000000000AC6000-memory.dmp

Filesize
88KB

Download
memory/1900-54-0x0000000000E20000-0x0000000000EDC000-memory.dmp

Filesize
752KB

Download
memory/1900-55-0x0000000075CB1000-0x0000000075CB3000-memory.dmp

Filesize
8KB

Download
memory/1900-78-0x0000000004E65000-0x0000000004E76000-memory.dmp

Filesize
68KB

Download
memory/1900-56-0x0000000004E65000-0x0000000004E76000-memory.dmp

Filesize
68KB

Download
memory/1900-60-0x000000000A220000-0x000000000A29C000-memory.dmp

Filesize
496KB

Download
memory/1900-59-0x0000000000BD0000-0x0000000000BDA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads