netwire | a1bc1aba176e99f0531b911a04d6c636ef21dab12d24026c672829d0c624e16e

General

Target

SV38848934334.exe
Size

1.3MB
MD5

2c9e24d3c041a463e8bb0d9d98606b21
SHA1

90a5098f8bf91b22b9688feeeb536ac1c0c7d4bb
SHA256

a1bc1aba176e99f0531b911a04d6c636ef21dab12d24026c672829d0c624e16e
SHA512

6fdf27ed733353d7cf81de4acdd3601859bbe47bbbeadaf0931bfd8c35ab6ebff237d1df8ce4d0f6b27457537a78cce3742e0d2b8c56e722e43c75af39a04e2a

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

xman2.duckdns.org:4433

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
lock_executable
false
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 7 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/584-69-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/584-71-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/584-72-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/584-74-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/584-75-0x000000000041AE7B-mapping.dmp	netwire
behavioral1/memory/584-78-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/584-80-0x0000000000400000-0x0000000000450000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

SV38848934334.exe

description pid process target process

PID 2012 set thread context of 584 2012 SV38848934334.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1564 schtasks.exe

description	pid	process	target process
PID 2012 set thread context of 584	2012	SV38848934334.exe	vbc.exe

pid	process
1564	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

SV38848934334.exepowershell.exe

pid	process
2012	SV38848934334.exe
2012	SV38848934334.exe
2012	SV38848934334.exe
2012	SV38848934334.exe
2012	SV38848934334.exe
2012	SV38848934334.exe
2012	SV38848934334.exe
2012	SV38848934334.exe
1628	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SV38848934334.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2012 SV38848934334.exe
Token: SeDebugPrivilege 1628 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2012	SV38848934334.exe
Token: SeDebugPrivilege	1628	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

SV38848934334.exe

description	pid	process	target process
PID 2012 wrote to memory of 1628	2012	SV38848934334.exe	powershell.exe
PID 2012 wrote to memory of 1628	2012	SV38848934334.exe	powershell.exe
PID 2012 wrote to memory of 1628	2012	SV38848934334.exe	powershell.exe
PID 2012 wrote to memory of 1628	2012	SV38848934334.exe	powershell.exe
PID 2012 wrote to memory of 1564	2012	SV38848934334.exe	schtasks.exe
PID 2012 wrote to memory of 1564	2012	SV38848934334.exe	schtasks.exe
PID 2012 wrote to memory of 1564	2012	SV38848934334.exe	schtasks.exe
PID 2012 wrote to memory of 1564	2012	SV38848934334.exe	schtasks.exe
PID 2012 wrote to memory of 776	2012	SV38848934334.exe	vbc.exe
PID 2012 wrote to memory of 776	2012	SV38848934334.exe	vbc.exe
PID 2012 wrote to memory of 776	2012	SV38848934334.exe	vbc.exe
PID 2012 wrote to memory of 776	2012	SV38848934334.exe	vbc.exe
PID 2012 wrote to memory of 584	2012	SV38848934334.exe	vbc.exe
PID 2012 wrote to memory of 584	2012	SV38848934334.exe	vbc.exe
PID 2012 wrote to memory of 584	2012	SV38848934334.exe	vbc.exe
PID 2012 wrote to memory of 584	2012	SV38848934334.exe	vbc.exe
PID 2012 wrote to memory of 584	2012	SV38848934334.exe	vbc.exe
PID 2012 wrote to memory of 584	2012	SV38848934334.exe	vbc.exe
PID 2012 wrote to memory of 584	2012	SV38848934334.exe	vbc.exe
PID 2012 wrote to memory of 584	2012	SV38848934334.exe	vbc.exe
PID 2012 wrote to memory of 584	2012	SV38848934334.exe	vbc.exe
PID 2012 wrote to memory of 584	2012	SV38848934334.exe	vbc.exe
PID 2012 wrote to memory of 584	2012	SV38848934334.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\SV38848934334.exe
"C:\Users\Admin\AppData\Local\Temp\SV38848934334.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QJxDsYCpllUT.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QJxDsYCpllUT" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDE8D.tmp"
2⤵
- Creates scheduled task(s)
PID:1564

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:776

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:584

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpDE8D.tmp
Filesize
1KB

MD5
bc89a8fd7b5bc46ca34ddb1d48ca73bf

SHA1
522c6e5c677a5c805e63abea0527dcab1e9b20d4

SHA256
71ee32704c2a4cf6bdfd34ea442f961579dbd1385043bcc17dc0d8060de8d867

SHA512
d7bda6886a0b33d5317d04e97ab5e9747a46c80773e9bc8a479a5ec9f16a4bab62f76e6ee9942ef3913dec65b53c9d305a011096e7621d0759076f869ef52a96

Download Submit
memory/584-74-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/584-69-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/584-64-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/584-80-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/584-65-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/584-78-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/584-75-0x000000000041AE7B-mapping.dmp

Download
memory/584-67-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/584-72-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/584-71-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1564-60-0x0000000000000000-mapping.dmp

Download
memory/1628-79-0x000000006F220000-0x000000006F7CB000-memory.dmp

Filesize
5.7MB

Download
memory/1628-81-0x000000006F220000-0x000000006F7CB000-memory.dmp

Filesize
5.7MB

Download
memory/1628-59-0x0000000000000000-mapping.dmp

Download
memory/2012-63-0x0000000004E80000-0x0000000004ED4000-memory.dmp

Filesize
336KB

Download
memory/2012-54-0x0000000000110000-0x000000000025A000-memory.dmp

Filesize
1.3MB

Download
memory/2012-55-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/2012-56-0x00000000006D0000-0x00000000006E6000-memory.dmp

Filesize
88KB

Download
memory/2012-58-0x000000000A410000-0x000000000A4B0000-memory.dmp

Filesize
640KB

Download
memory/2012-57-0x00000000006E0000-0x00000000006EA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads