netwire | 2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58

General

Target

BinaryWr.exe
Size

1.2MB
MD5

e366f96c9b5c5528426a116eb49ef445
SHA1

8062220b613b56116d638b3d7f5dd043f3bc096e
SHA256

2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58
SHA512

1dc21da10c45a5fbd5058e85d775cccec140a0fec067183013457d7ab87f9bfd758429a999df2b2bf0afd19d44b289418c6a8457689346521764a812a0430e9d

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

xman2.duckdns.org:4433

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
lock_executable
false
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 7 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1112-69-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1112-71-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1112-72-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1112-74-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1112-75-0x000000000041AE7B-mapping.dmp	netwire
behavioral1/memory/1112-78-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1112-80-0x0000000000400000-0x0000000000450000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

BinaryWr.exe

description pid process target process

PID 912 set thread context of 1112 912 BinaryWr.exe BinaryWr.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1972 schtasks.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

BinaryWr.exepowershell.exe

pid process

912 BinaryWr.exe
912 BinaryWr.exe
912 BinaryWr.exe
912 BinaryWr.exe
912 BinaryWr.exe
912 BinaryWr.exe
2028 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

BinaryWr.exepowershell.exe

description pid process

Token: SeDebugPrivilege 912 BinaryWr.exe
Token: SeDebugPrivilege 2028 powershell.exe

description	pid	process	target process
PID 912 set thread context of 1112	912	BinaryWr.exe	BinaryWr.exe

pid	process
1972	schtasks.exe

pid	process
912	BinaryWr.exe
912	BinaryWr.exe
912	BinaryWr.exe
912	BinaryWr.exe
912	BinaryWr.exe
912	BinaryWr.exe
2028	powershell.exe

description	pid	process
Token: SeDebugPrivilege	912	BinaryWr.exe
Token: SeDebugPrivilege	2028	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

BinaryWr.exe

description	pid	process	target process
PID 912 wrote to memory of 2028	912	BinaryWr.exe	powershell.exe
PID 912 wrote to memory of 2028	912	BinaryWr.exe	powershell.exe
PID 912 wrote to memory of 2028	912	BinaryWr.exe	powershell.exe
PID 912 wrote to memory of 2028	912	BinaryWr.exe	powershell.exe
PID 912 wrote to memory of 1972	912	BinaryWr.exe	schtasks.exe
PID 912 wrote to memory of 1972	912	BinaryWr.exe	schtasks.exe
PID 912 wrote to memory of 1972	912	BinaryWr.exe	schtasks.exe
PID 912 wrote to memory of 1972	912	BinaryWr.exe	schtasks.exe
PID 912 wrote to memory of 1112	912	BinaryWr.exe	BinaryWr.exe
PID 912 wrote to memory of 1112	912	BinaryWr.exe	BinaryWr.exe
PID 912 wrote to memory of 1112	912	BinaryWr.exe	BinaryWr.exe
PID 912 wrote to memory of 1112	912	BinaryWr.exe	BinaryWr.exe
PID 912 wrote to memory of 1112	912	BinaryWr.exe	BinaryWr.exe
PID 912 wrote to memory of 1112	912	BinaryWr.exe	BinaryWr.exe
PID 912 wrote to memory of 1112	912	BinaryWr.exe	BinaryWr.exe
PID 912 wrote to memory of 1112	912	BinaryWr.exe	BinaryWr.exe
PID 912 wrote to memory of 1112	912	BinaryWr.exe	BinaryWr.exe
PID 912 wrote to memory of 1112	912	BinaryWr.exe	BinaryWr.exe
PID 912 wrote to memory of 1112	912	BinaryWr.exe	BinaryWr.exe

C:\Users\Admin\AppData\Local\Temp\BinaryWr.exe
"C:\Users\Admin\AppData\Local\Temp\BinaryWr.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rWWREmAZOgElhb.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2028

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rWWREmAZOgElhb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE283.tmp"
2⤵
- Creates scheduled task(s)
PID:1972

C:\Users\Admin\AppData\Local\Temp\BinaryWr.exe
"C:\Users\Admin\AppData\Local\Temp\BinaryWr.exe"
2⤵
PID:1112

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE283.tmp
Filesize
1KB

MD5
f113075150d6fc4a84e6373c03ae954b

SHA1
b010ffd275953f366e67fe2db5e7189f85c852e9

SHA256
3ab61549518cee4c99de89b22b99c398ad3889f82330e57319c755b5b21977fd

SHA512
de40b64833cfd6c30ea37d2df34df88e6d2c286f1075407a0dedecb2d93b82ba1d20bfe6c92bfc1d2c58e10beeda152d8fcc25371cd80406384f0c67c25e3725

Download Submit
memory/912-55-0x0000000074DB1000-0x0000000074DB3000-memory.dmp

Filesize
8KB

Download
memory/912-56-0x00000000002C0000-0x00000000002D6000-memory.dmp

Filesize
88KB

Download
memory/912-57-0x00000000002F0000-0x00000000002FA000-memory.dmp

Filesize
40KB

Download
memory/912-58-0x000000000A430000-0x000000000A4C8000-memory.dmp

Filesize
608KB

Download
memory/912-54-0x0000000000A70000-0x0000000000BB4000-memory.dmp

Filesize
1.3MB

Download
memory/912-63-0x0000000005000000-0x000000000504C000-memory.dmp

Filesize
304KB

Download
memory/1112-74-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1112-72-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1112-64-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1112-65-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1112-67-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1112-69-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1112-71-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1112-80-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1112-78-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1112-75-0x000000000041AE7B-mapping.dmp

Download
memory/1972-60-0x0000000000000000-mapping.dmp

Download
memory/2028-59-0x0000000000000000-mapping.dmp

Download
memory/2028-79-0x000000006BED0000-0x000000006C47B000-memory.dmp

Filesize
5.7MB

Download
memory/2028-81-0x000000006BED0000-0x000000006C47B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads