netwire | e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b

General

Target

e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Size

280KB
MD5

062c777eee936d3b7d4f0eda94298251
SHA1

2dfa19103143f99afd688265a83a08b6aa8794a5
SHA256

e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b
SHA512

11fa3efaed4a32f43a24f3e8e20855259a72dd427e7ee744b2a4b26c20b8ccb9edd56056f841dfa0f7c66ffe5bb49d882f57f0729599ac2ef99116e2a519c4a9

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

185.244.129.107:3360

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Lols\
lock_executable
false
mutex
HDDkuTxC
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/732-132-0x0000000000630000-0x000000000065C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Modifies registry class 18 IoCs

Processes:

e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E31F85~1.EXE,0"	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\shell\open\command	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\shell	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E31F85~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\""	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.srl\ = "GenericSerializeDemo.Document"	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\DefaultIcon	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\shell\printto\command	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\shell\printto	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.srl	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.srl\ShellNew\NullFile	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\ = "Generi Document"	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E31F85~1.EXE \"%1\""	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\shell\print\command	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E31F85~1.EXE /p \"%1\""	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\shell\open	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericSerializeDemo.Document\shell\print	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.srl\ShellNew	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe

pid process

1876 e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe

pid	process
1876	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe

description	pid	process	target process
PID 1876 wrote to memory of 732	1876	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe	wermgr.exe
PID 1876 wrote to memory of 732	1876	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe	wermgr.exe
PID 1876 wrote to memory of 732	1876	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe	wermgr.exe
PID 1876 wrote to memory of 732	1876	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe	wermgr.exe
PID 1876 wrote to memory of 732	1876	e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe
"C:\Users\Admin\AppData\Local\Temp\e31f852fa88e730c8a6ff833b58a259fecdec0443ad81895ba97c92320027e6b.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\SysWOW64\wermgr.exe
"C:\Windows\System32\wermgr.exe"
2⤵
PID:732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/732-131-0x0000000000000000-mapping.dmp

Download
memory/732-132-0x0000000000630000-0x000000000065C000-memory.dmp

Filesize
176KB

Download
memory/1876-130-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads