netwire | 5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6

General

Target

5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe
Size

720KB
MD5

dde1d2bff5076a07a34a3d079eb42603
SHA1

5255caf6bc8aa67a7b5c22fbe15b1dff34155905
SHA256

5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6
SHA512

53ffed18d0f2a6efdb567d60ef6cd81189bd319cfb6cd0929d603914b7c00674b75c793e92311d6bc9e14116cf5814a3e0e3805a52f95ad3fabc8e947684be05
SSDEEP

12288:UbpM2Tgxl6b6JBAdDz7/VFbxJxBsIfL+3wFtmTAnPmJDOLxAyIFmki9bF3:UbfggDDb7xFK3w9nPm5Zk3

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

212.193.30.230:4000

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
Okonkwo
lock_executable
true
mutex
ltpFhccL
offline_keylogger
false
password
4QR5EtvOH9
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 9 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1776-69-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1776-70-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1776-71-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1776-73-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1776-75-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1776-74-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1776-78-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1776-79-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1776-82-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

Processes:

5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe

description	pid	process	target process
PID 1504 set thread context of 1776	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2016 schtasks.exe

pid	process
2016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exepowershell.exe

pid	process
1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe
1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe
1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe
1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe
1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe
1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe
2020	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe
Token: SeDebugPrivilege	2020	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe

C:\Users\Admin\AppData\Local\Temp\5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe
"C:\Users\Admin\AppData\Local\Temp\5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vZDxGCJn.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vZDxGCJn" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF4DB.tmp"
2⤵
- Creates scheduled task(s)
PID:2016

C:\Users\Admin\AppData\Local\Temp\5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe
"C:\Users\Admin\AppData\Local\Temp\5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe"
2⤵
PID:1776

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF4DB.tmp
Filesize
1KB

MD5
4cb23f8ea5b4127e5050fdef499feed3

SHA1
7f98e3791efc3622dfe4b7294156224bf4bd97d2

SHA256
350699498721c014ef7082aa84492603a5263f91c4b3086139b62b5f549b5101

SHA512
17f34f6f407b7e164449a15bb7aa9b09f877e0fb7d0347c415249a27c3681577ba4bb0e3901f9031a8af4b752c17b0e508302422abbeda97e3dd26c0753c07bd

Download Submit
memory/1504-55-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/1504-56-0x0000000000300000-0x0000000000318000-memory.dmp

Filesize
96KB

Download
memory/1504-57-0x0000000000270000-0x000000000027C000-memory.dmp

Filesize
48KB

Download
memory/1504-58-0x0000000005C20000-0x0000000005C94000-memory.dmp

Filesize
464KB

Download
memory/1504-54-0x0000000000330000-0x00000000003EA000-memory.dmp

Filesize
744KB

Download
memory/1504-63-0x0000000005130000-0x000000000515E000-memory.dmp

Filesize
184KB

Download
memory/1776-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1776-71-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1776-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1776-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1776-67-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1776-69-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1776-70-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1776-82-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1776-79-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1776-75-0x000000000040242D-mapping.dmp

Download
memory/1776-74-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1776-78-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2016-60-0x0000000000000000-mapping.dmp

Download
memory/2020-59-0x0000000000000000-mapping.dmp

Download
memory/2020-80-0x000000006F090000-0x000000006F63B000-memory.dmp

Filesize
5.7MB

Download
memory/2020-81-0x000000006F090000-0x000000006F63B000-memory.dmp

Filesize
5.7MB

Download

description	pid	process	target process
PID 1504 wrote to memory of 2020	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe	powershell.exe
PID 1504 wrote to memory of 2020	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe	powershell.exe
PID 1504 wrote to memory of 2020	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe	powershell.exe
PID 1504 wrote to memory of 2020	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe	powershell.exe
PID 1504 wrote to memory of 2016	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe	schtasks.exe
PID 1504 wrote to memory of 2016	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe	schtasks.exe
PID 1504 wrote to memory of 2016	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe	schtasks.exe
PID 1504 wrote to memory of 2016	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe	schtasks.exe
PID 1504 wrote to memory of 1776	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe
PID 1504 wrote to memory of 1776	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe
PID 1504 wrote to memory of 1776	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe
PID 1504 wrote to memory of 1776	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe
PID 1504 wrote to memory of 1776	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe
PID 1504 wrote to memory of 1776	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe
PID 1504 wrote to memory of 1776	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe
PID 1504 wrote to memory of 1776	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe
PID 1504 wrote to memory of 1776	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe
PID 1504 wrote to memory of 1776	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe
PID 1504 wrote to memory of 1776	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe
PID 1504 wrote to memory of 1776	1504	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe	5c49bfd97ea20083080e81c025dbbc5bafdeadf692de79cba059442a2c0bf8b6.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads