netwire | 43515ecf901ddf50a3dbc0e8e1915a61e390a77b5f1c9f52846ecbb68bb3b6e0

General

Target

9a6a37c3a88223561379759bac35b1c9.exe
Size

876KB
MD5

9a6a37c3a88223561379759bac35b1c9
SHA1

e33f8289f8f9c0d5b33b4cc33b19829c45c30f11
SHA256

43515ecf901ddf50a3dbc0e8e1915a61e390a77b5f1c9f52846ecbb68bb3b6e0
SHA512

20ae93552cbf3c5596b413e6c83a3858fa481f2eab4eca1001dad987a8a2aeb8587cc45b3d0726255957cbd80150823a07dc42ea800e70b6db9be16a3137b4d6

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

194.5.98.126:3378

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Pass@2023
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3660-142-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/3660-145-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/3660-147-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/3660-159-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/3660-160-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9a6a37c3a88223561379759bac35b1c9.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	9a6a37c3a88223561379759bac35b1c9.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

9a6a37c3a88223561379759bac35b1c9.exe

description pid process target process

PID 4828 set thread context of 3660 4828 9a6a37c3a88223561379759bac35b1c9.exe 9a6a37c3a88223561379759bac35b1c9.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1428 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

2392 powershell.exe
2392 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2392 powershell.exe

description	pid	process	target process
PID 4828 set thread context of 3660	4828	9a6a37c3a88223561379759bac35b1c9.exe	9a6a37c3a88223561379759bac35b1c9.exe

pid	process
1428	schtasks.exe

pid	process
2392	powershell.exe
2392	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2392	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

9a6a37c3a88223561379759bac35b1c9.exe

C:\Users\Admin\AppData\Local\Temp\9a6a37c3a88223561379759bac35b1c9.exe
"C:\Users\Admin\AppData\Local\Temp\9a6a37c3a88223561379759bac35b1c9.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4828

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qBSbhm.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qBSbhm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp62D1.tmp"
2⤵
- Creates scheduled task(s)
PID:1428

C:\Users\Admin\AppData\Local\Temp\9a6a37c3a88223561379759bac35b1c9.exe
"C:\Users\Admin\AppData\Local\Temp\9a6a37c3a88223561379759bac35b1c9.exe"
2⤵
PID:3660

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp62D1.tmp
Filesize
1KB

MD5
db70cecfa76fd85c7aa992e956184da1

SHA1
5cf1cecf90a210ce74a87d456c05965c30ebdd7e

SHA256
10dffc208ec7d0abfdd3c01d63aa90a2228f468010ef86e1ed1936d367b0bfce

SHA512
c5d93f745deaa00cf6c41961c4a6a3219860b8202a0528c29b968d44800869cdcdf65b81f43850ee04d1342f4e62b85e04998610c35449c415fa3790d7973707

Download Submit
memory/1428-137-0x0000000000000000-mapping.dmp

Download
memory/2392-152-0x0000000008060000-0x00000000086DA000-memory.dmp

Filesize
6.5MB

Download
memory/2392-144-0x00000000055C0000-0x00000000055E2000-memory.dmp

Filesize
136KB

Download
memory/2392-154-0x0000000007A70000-0x0000000007A7A000-memory.dmp

Filesize
40KB

Download
memory/2392-153-0x0000000007A00000-0x0000000007A1A000-memory.dmp

Filesize
104KB

Download
memory/2392-136-0x0000000000000000-mapping.dmp

Download
memory/2392-146-0x0000000005760000-0x00000000057C6000-memory.dmp

Filesize
408KB

Download
memory/2392-138-0x0000000002D70000-0x0000000002DA6000-memory.dmp

Filesize
216KB

Download
memory/2392-157-0x0000000007D40000-0x0000000007D5A000-memory.dmp

Filesize
104KB

Download
memory/2392-140-0x00000000058B0000-0x0000000005ED8000-memory.dmp

Filesize
6.2MB

Download
memory/2392-156-0x0000000007C30000-0x0000000007C3E000-memory.dmp

Filesize
56KB

Download
memory/2392-150-0x0000000071090000-0x00000000710DC000-memory.dmp

Filesize
304KB

Download
memory/2392-155-0x0000000007C80000-0x0000000007D16000-memory.dmp

Filesize
600KB

Download
memory/2392-149-0x00000000076F0000-0x0000000007722000-memory.dmp

Filesize
200KB

Download
memory/2392-158-0x0000000007D20000-0x0000000007D28000-memory.dmp

Filesize
32KB

Download
memory/2392-151-0x0000000006CB0000-0x0000000006CCE000-memory.dmp

Filesize
120KB

Download
memory/2392-148-0x0000000006700000-0x000000000671E000-memory.dmp

Filesize
120KB

Download
memory/3660-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3660-142-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3660-147-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3660-141-0x0000000000000000-mapping.dmp

Download
memory/3660-159-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3660-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4828-131-0x0000000005B30000-0x00000000060D4000-memory.dmp

Filesize
5.6MB

Download
memory/4828-130-0x0000000000AD0000-0x0000000000BB0000-memory.dmp

Filesize
896KB

Download
memory/4828-133-0x0000000005710000-0x000000000571A000-memory.dmp

Filesize
40KB

Download
memory/4828-132-0x0000000005580000-0x0000000005612000-memory.dmp

Filesize
584KB

Download
memory/4828-135-0x0000000009090000-0x00000000090F6000-memory.dmp

Filesize
408KB

Download
memory/4828-134-0x0000000008FF0000-0x000000000908C000-memory.dmp

Filesize
624KB

Download

description	pid	process	target process
PID 4828 wrote to memory of 2392	4828	9a6a37c3a88223561379759bac35b1c9.exe	powershell.exe
PID 4828 wrote to memory of 2392	4828	9a6a37c3a88223561379759bac35b1c9.exe	powershell.exe
PID 4828 wrote to memory of 2392	4828	9a6a37c3a88223561379759bac35b1c9.exe	powershell.exe
PID 4828 wrote to memory of 1428	4828	9a6a37c3a88223561379759bac35b1c9.exe	schtasks.exe
PID 4828 wrote to memory of 1428	4828	9a6a37c3a88223561379759bac35b1c9.exe	schtasks.exe
PID 4828 wrote to memory of 1428	4828	9a6a37c3a88223561379759bac35b1c9.exe	schtasks.exe
PID 4828 wrote to memory of 3660	4828	9a6a37c3a88223561379759bac35b1c9.exe	9a6a37c3a88223561379759bac35b1c9.exe
PID 4828 wrote to memory of 3660	4828	9a6a37c3a88223561379759bac35b1c9.exe	9a6a37c3a88223561379759bac35b1c9.exe
PID 4828 wrote to memory of 3660	4828	9a6a37c3a88223561379759bac35b1c9.exe	9a6a37c3a88223561379759bac35b1c9.exe
PID 4828 wrote to memory of 3660	4828	9a6a37c3a88223561379759bac35b1c9.exe	9a6a37c3a88223561379759bac35b1c9.exe
PID 4828 wrote to memory of 3660	4828	9a6a37c3a88223561379759bac35b1c9.exe	9a6a37c3a88223561379759bac35b1c9.exe
PID 4828 wrote to memory of 3660	4828	9a6a37c3a88223561379759bac35b1c9.exe	9a6a37c3a88223561379759bac35b1c9.exe
PID 4828 wrote to memory of 3660	4828	9a6a37c3a88223561379759bac35b1c9.exe	9a6a37c3a88223561379759bac35b1c9.exe
PID 4828 wrote to memory of 3660	4828	9a6a37c3a88223561379759bac35b1c9.exe	9a6a37c3a88223561379759bac35b1c9.exe
PID 4828 wrote to memory of 3660	4828	9a6a37c3a88223561379759bac35b1c9.exe	9a6a37c3a88223561379759bac35b1c9.exe
PID 4828 wrote to memory of 3660	4828	9a6a37c3a88223561379759bac35b1c9.exe	9a6a37c3a88223561379759bac35b1c9.exe
PID 4828 wrote to memory of 3660	4828	9a6a37c3a88223561379759bac35b1c9.exe	9a6a37c3a88223561379759bac35b1c9.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads