netwire | d49ae415cb86861a5dda7254a78dc8a2f68b4976e92cb3c5a62584c33375bdeb

Analysis

max time kernel
51s
max time network
55s
platform
windows10_x64
resource
win10-20220414-en
resource tags

arch:x64arch:x86image:win10-20220414-enlocale:en-usos:windows10-1703-x64system
submitted
02-08-2022 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d49ae415cb86861a5dda7254a78dc8a2f68b4976e92cb3c5a62584c33375bdeb.exe
Size

273KB
MD5

b701f11ecf355febaa54d234d9b33529
SHA1

7e4284a948d832df348de41751a5e4a629f069b8
SHA256

d49ae415cb86861a5dda7254a78dc8a2f68b4976e92cb3c5a62584c33375bdeb
SHA512

d9da904e7ee28e7d2977212e7b5eefb17f85c2d38029d4605b7c3b36167d0bf2699123041c11fd72a5791e0e21f53b01340963c9affb73ef9901b34c5f5089bb

Score

10^/10

netwire botnet spyware stealer upx

Malware Config

Signatures

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Sqlite3\sqlite3.dll	acprotect
\Users\Admin\AppData\Roaming\Sqlite3\sqlite3.dll	acprotect

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Sqlite3\sqlite3.dll	upx
behavioral1/memory/1312-169-0x0000000010000000-0x000000001005A000-memory.dmp	upx
\Users\Admin\AppData\Roaming\Sqlite3\sqlite3.dll	upx

Loads dropped DLL 2 IoCs

Processes:

d49ae415cb86861a5dda7254a78dc8a2f68b4976e92cb3c5a62584c33375bdeb.exe

pid	process
1312	d49ae415cb86861a5dda7254a78dc8a2f68b4976e92cb3c5a62584c33375bdeb.exe
1312	d49ae415cb86861a5dda7254a78dc8a2f68b4976e92cb3c5a62584c33375bdeb.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4724 1312 WerFault.exe d49ae415cb86861a5dda7254a78dc8a2f68b4976e92cb3c5a62584c33375bdeb.exe

pid	pid_target	process	target process
4724	1312	WerFault.exe	d49ae415cb86861a5dda7254a78dc8a2f68b4976e92cb3c5a62584c33375bdeb.exe

C:\Users\Admin\AppData\Local\Temp\d49ae415cb86861a5dda7254a78dc8a2f68b4976e92cb3c5a62584c33375bdeb.exe
"C:\Users\Admin\AppData\Local\Temp\d49ae415cb86861a5dda7254a78dc8a2f68b4976e92cb3c5a62584c33375bdeb.exe"
1⤵
- Loads dropped DLL
PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 856
2⤵
- Program crash
PID:4724

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Sqlite3\sqlite3.dll
Filesize
171KB

MD5
1023df7abd2d9b7f0bdc77024c978f0b

SHA1
86f779a7bb2878bb0cc24cece2130bc451124a1d

SHA256
d7067d18aff17bbd5013a708f02e5d87beb20af19f2381986952a119ce5cf420

SHA512
1da1ca20319f9da92f1a1f0a2e590dcd1a87b8a2dd340b36ce680626ba68937a5f3c5f807afe29cb01e0000772044b892ed4cd1cf82337666fea7efc1955ecf7

Download Submit
\Users\Admin\AppData\Roaming\Sqlite3\sqlite3.dll
Filesize
171KB

MD5
1023df7abd2d9b7f0bdc77024c978f0b

SHA1
86f779a7bb2878bb0cc24cece2130bc451124a1d

SHA256
d7067d18aff17bbd5013a708f02e5d87beb20af19f2381986952a119ce5cf420

SHA512
1da1ca20319f9da92f1a1f0a2e590dcd1a87b8a2dd340b36ce680626ba68937a5f3c5f807afe29cb01e0000772044b892ed4cd1cf82337666fea7efc1955ecf7

Download Submit
memory/1312-146-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-131-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-119-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-120-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-121-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-122-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-123-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-124-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-125-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-126-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-127-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-128-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-129-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-144-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-130-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-132-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-133-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-134-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-135-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-136-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-137-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-138-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-139-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-140-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-141-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-142-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-143-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-145-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-147-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-148-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-151-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-150-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-154-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-118-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-149-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-152-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-153-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-115-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-155-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-156-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-157-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-158-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-159-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-160-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-161-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-162-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-163-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-164-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-165-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-117-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-167-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-168-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-169-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download
memory/1312-170-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-171-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-172-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-173-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-174-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-176-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-116-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-177-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-178-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-180-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download
memory/1312-179-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-181-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1312-182-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download