netwire | c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9

Analysis

max time kernel
284s
max time network
288s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
29-08-2022 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe
Size

657KB
MD5

0c8c56aeba6d889647f2ed68f7461ef0
SHA1

4e2da2d80922f254fc5d681b6ca4cf4fe35b5163
SHA256

c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9
SHA512

b11f73cfe702544757ae662ea3410df57b466e50a9177c357e1df516e949de9b8114fc6ea9364cde8dcbe6283d9c3b1d76a427f39fa8472a3984d1150d5057f0
SSDEEP

12288:VCyKwhKlgghh9ejNbn5Y9KMf46aJjShRDACEkM2TgwFmki9bF:6wkyjNb5Y9KMgFoRREugCk

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

185.140.53.61:3363

185.140.53.61:3365

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
move4ward
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4860-251-0x000000000040242D-mapping.dmp	netwire
behavioral2/memory/4860-328-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/4860-593-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

Processes:

c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe

description	pid	process	target process
PID 3668 set thread context of 4860	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4372 schtasks.exe

pid	process
4372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exepowershell.exe

pid	process
3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe
3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe
1860	powershell.exe
1860	powershell.exe
1860	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe
Token: SeDebugPrivilege	1860	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe

C:\Users\Admin\AppData\Local\Temp\c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe
"C:\Users\Admin\AppData\Local\Temp\c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BGieLAVcn.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BGieLAVcn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3A0B.tmp"
2⤵
- Creates scheduled task(s)
PID:4372

C:\Users\Admin\AppData\Local\Temp\c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe
"C:\Users\Admin\AppData\Local\Temp\c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe"
2⤵
PID:3960

C:\Users\Admin\AppData\Local\Temp\c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe
"C:\Users\Admin\AppData\Local\Temp\c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe"
2⤵
PID:4860

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3A0B.tmp
Filesize
1KB

MD5
da0d82797d887a93668830635330edc5

SHA1
798240bfe5df0880b05d018980d1d76dbb916513

SHA256
2d95e66e65120930226de52dcb57e59895a0c378d8ed22e61f2699ce6d0717c3

SHA512
3a8ad95d4460647de0c763440b46ff3233f04780e604e83bf2a6881efc5d4e5f5575df198aa539c5284fe3d4f06954a2092daac6bfded099543a93b3a0a236ec

Download Submit
memory/1860-195-0x0000000000000000-mapping.dmp

Download
memory/1860-258-0x0000000006BE0000-0x0000000006C16000-memory.dmp

Filesize
216KB

Download
memory/1860-272-0x0000000007310000-0x0000000007938000-memory.dmp

Filesize
6.2MB

Download
memory/1860-314-0x0000000007940000-0x0000000007962000-memory.dmp

Filesize
136KB

Download
memory/1860-575-0x0000000009700000-0x0000000009708000-memory.dmp

Filesize
32KB

Download
memory/1860-570-0x0000000009720000-0x000000000973A000-memory.dmp

Filesize
104KB

Download
memory/1860-367-0x00000000097C0000-0x0000000009854000-memory.dmp

Filesize
592KB

Download
memory/1860-363-0x00000000095A0000-0x0000000009645000-memory.dmp

Filesize
660KB

Download
memory/1860-354-0x0000000009440000-0x000000000945E000-memory.dmp

Filesize
120KB

Download
memory/1860-353-0x0000000009460000-0x0000000009493000-memory.dmp

Filesize
204KB

Download
memory/1860-340-0x0000000008450000-0x00000000084C6000-memory.dmp

Filesize
472KB

Download
memory/1860-336-0x00000000082C0000-0x000000000830B000-memory.dmp

Filesize
300KB

Download
memory/1860-335-0x0000000007CB0000-0x0000000007CCC000-memory.dmp

Filesize
112KB

Download
memory/1860-322-0x0000000007CE0000-0x0000000008030000-memory.dmp

Filesize
3.3MB

Download
memory/1860-318-0x00000000079E0000-0x0000000007A46000-memory.dmp

Filesize
408KB

Download
memory/1860-316-0x0000000007BC0000-0x0000000007C26000-memory.dmp

Filesize
408KB

Download
memory/3668-160-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-159-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-142-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-140-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-137-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-135-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-143-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-144-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-145-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-132-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-130-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-129-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-127-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-126-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-146-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-124-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-123-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-147-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-148-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-149-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-151-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-152-0x0000000000BC0000-0x0000000000C6A000-memory.dmp

Filesize
680KB

Download
memory/3668-150-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-153-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-154-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-156-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-155-0x00000000059C0000-0x0000000005EBE000-memory.dmp

Filesize
5.0MB

Download
memory/3668-157-0x00000000054C0000-0x0000000005552000-memory.dmp

Filesize
584KB

Download
memory/3668-158-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-138-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-161-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-164-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-166-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-165-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-167-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-163-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-168-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-162-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-169-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-141-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-170-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-171-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-172-0x0000000005480000-0x000000000548A000-memory.dmp

Filesize
40KB

Download
memory/3668-174-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-175-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-173-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-177-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-178-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-176-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-180-0x0000000007820000-0x0000000007838000-memory.dmp

Filesize
96KB

Download
memory/3668-179-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-181-0x0000000009FB0000-0x0000000009FBC000-memory.dmp

Filesize
48KB

Download
memory/3668-182-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-183-0x000000000A200000-0x000000000A274000-memory.dmp

Filesize
464KB

Download
memory/3668-184-0x000000000A310000-0x000000000A3AC000-memory.dmp

Filesize
624KB

Download
memory/3668-185-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-186-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-187-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-188-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-189-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-139-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-136-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-134-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-243-0x000000000A2D0000-0x000000000A2FE000-memory.dmp

Filesize
184KB

Download
memory/3668-118-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-121-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-120-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-133-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-131-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-128-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-125-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-122-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-119-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4372-197-0x0000000000000000-mapping.dmp

Download
memory/4860-328-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4860-251-0x000000000040242D-mapping.dmp

Download
memory/4860-593-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

description	pid	process	target process
PID 3668 wrote to memory of 1860	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe	powershell.exe
PID 3668 wrote to memory of 1860	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe	powershell.exe
PID 3668 wrote to memory of 1860	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe	powershell.exe
PID 3668 wrote to memory of 4372	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe	schtasks.exe
PID 3668 wrote to memory of 4372	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe	schtasks.exe
PID 3668 wrote to memory of 4372	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe	schtasks.exe
PID 3668 wrote to memory of 3960	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe
PID 3668 wrote to memory of 3960	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe
PID 3668 wrote to memory of 3960	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe
PID 3668 wrote to memory of 4860	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe
PID 3668 wrote to memory of 4860	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe
PID 3668 wrote to memory of 4860	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe
PID 3668 wrote to memory of 4860	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe
PID 3668 wrote to memory of 4860	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe
PID 3668 wrote to memory of 4860	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe
PID 3668 wrote to memory of 4860	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe
PID 3668 wrote to memory of 4860	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe
PID 3668 wrote to memory of 4860	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe
PID 3668 wrote to memory of 4860	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe
PID 3668 wrote to memory of 4860	3668	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe	c94a8c659cf201ee1de19fc9a95bd13abdb17eef4805b9546b7c54996f04dbf9.exe