netwire | 8d30b1713bdbee571ed08365e29d34de1fd0d152a9d816a1e315d92b384f94e9

General

Target

Payment confirmation.exe
Size

829KB
MD5

ba419928d6a9ef178f04260d57f1df7e
SHA1

754c7e767823aa6b39db9266c3fbd6f466b942a8
SHA256

8d30b1713bdbee571ed08365e29d34de1fd0d152a9d816a1e315d92b384f94e9
SHA512

1a33cb673c9117b24e3699117d5de8a49e9e0c5c08a9b115edd4524e58e6a9b8c9f61672035147b7b3c726711c67f0ff902ce28a3fe2511db0d1aa3e4ad42f34

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

185.140.53.61:3363

185.140.53.61:3365

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
move4ward
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2104-138-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/2104-140-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/2104-141-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/2104-142-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Payment confirmation.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	Payment confirmation.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Payment confirmation.exe

description pid process target process

PID 1624 set thread context of 2104 1624 Payment confirmation.exe Payment confirmation.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1208 schtasks.exe

description	pid	process	target process
PID 1624 set thread context of 2104	1624	Payment confirmation.exe	Payment confirmation.exe

pid	process
1208	schtasks.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Payment confirmation.exe

description	pid	process	target process
PID 1624 wrote to memory of 1208	1624	Payment confirmation.exe	schtasks.exe
PID 1624 wrote to memory of 1208	1624	Payment confirmation.exe	schtasks.exe
PID 1624 wrote to memory of 1208	1624	Payment confirmation.exe	schtasks.exe
PID 1624 wrote to memory of 2104	1624	Payment confirmation.exe	Payment confirmation.exe
PID 1624 wrote to memory of 2104	1624	Payment confirmation.exe	Payment confirmation.exe
PID 1624 wrote to memory of 2104	1624	Payment confirmation.exe	Payment confirmation.exe
PID 1624 wrote to memory of 2104	1624	Payment confirmation.exe	Payment confirmation.exe
PID 1624 wrote to memory of 2104	1624	Payment confirmation.exe	Payment confirmation.exe
PID 1624 wrote to memory of 2104	1624	Payment confirmation.exe	Payment confirmation.exe
PID 1624 wrote to memory of 2104	1624	Payment confirmation.exe	Payment confirmation.exe
PID 1624 wrote to memory of 2104	1624	Payment confirmation.exe	Payment confirmation.exe
PID 1624 wrote to memory of 2104	1624	Payment confirmation.exe	Payment confirmation.exe
PID 1624 wrote to memory of 2104	1624	Payment confirmation.exe	Payment confirmation.exe
PID 1624 wrote to memory of 2104	1624	Payment confirmation.exe	Payment confirmation.exe

C:\Users\Admin\AppData\Local\Temp\Payment confirmation.exe
"C:\Users\Admin\AppData\Local\Temp\Payment confirmation.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QuJxuK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4B3.tmp"
2⤵
- Creates scheduled task(s)
PID:1208

C:\Users\Admin\AppData\Local\Temp\Payment confirmation.exe
"{path}"
2⤵
PID:2104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4B3.tmp

Filesize
1KB

MD5
d1d8fce0708ce719ab031ff9914837f3

SHA1
8a74428688672cbab82ebb39b16cf268d414f7a9

SHA256
aa07e2d275c0b2b3401b4376e9713fae3882ebc90f383805ec100a964b54b689

SHA512
e1c5115430f1e1cb6e45e3cbb59b15b9d4a9f3395421556715a73185f080e79d9b9fdb8163d2590fba2e719c6a81c5fbf2af61de6b62044f9998aadf14fe7ddd

Download Submit
memory/1208-135-0x0000000000000000-mapping.dmp

Download
memory/1624-130-0x0000000000BD0000-0x0000000000CA4000-memory.dmp

Filesize
848KB

Download
memory/1624-131-0x0000000008040000-0x00000000085E4000-memory.dmp

Filesize
5.6MB

Download
memory/1624-132-0x0000000007B30000-0x0000000007BC2000-memory.dmp

Filesize
584KB

Download
memory/1624-133-0x0000000007BD0000-0x0000000007C6C000-memory.dmp

Filesize
624KB

Download
memory/1624-134-0x0000000007B10000-0x0000000007B1A000-memory.dmp

Filesize
40KB

Download
memory/2104-137-0x0000000000000000-mapping.dmp

Download
memory/2104-138-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2104-140-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2104-141-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2104-142-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads