netwire | 9e31da664bede9c4709cdbf2ec6a791dadc490cd30a67a3d2bbae42c7e9318ed

Analysis

max time kernel
149s
max time network
177s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/08/2022, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe
Size 779KB
Sample220830-1ea1gsccd2
SHA256 9e31da664bede9c4709cdbf2ec6a791dadc490cd30a67a3d2bbae42c7e9318ed
MD5 bec825008e3f4365a8a71961ba806f27
SHA1 a0f073d37901dd918af4e58f82a19e46479edc6b
SHA512 c251ee9de6053e57a0547f31b3469a6dc70619b6562c5345f3d76b8ffbc06b07c86749908f8eae1a7216a9c0c41eb1bbcc22318f6e5eefd6b1ee206c62be7526
SSDEEP 12288:osUf0eH06SolylSx1XqVlSyH0f67ajvKVl94tu1UNPuEz4YTLvNcMb4IoR55KFe:Xg3uSyUi7Iq9Z1UpuRMPoR5E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

37.0.14.206:3384

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
true
offline_keylogger
true
password
Password234
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 11 IoCs

rat

resource	yara_rule
behavioral1/memory/976-66-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/976-67-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/976-68-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/976-70-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/976-71-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/976-72-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/976-75-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/976-76-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1804-98-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1804-102-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1804-103-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Executes dropped EXE 4 IoCs

pid	Process
1740	Host.exe
1820	Host.exe
1652	Host.exe
1804	Host.exe

Loads dropped DLL 1 IoCs

pid	Process
976	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 780 set thread context of 976	780	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe	29
PID 1740 set thread context of 1804	1740	Host.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1140	schtasks.exe
1900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
780	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe
1740	Host.exe
1740	Host.exe
1740	Host.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	780	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe
Token: SeDebugPrivilege	1740	Host.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1900	780	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe	27
PID 780 wrote to memory of 1900	780	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe	27
PID 780 wrote to memory of 1900	780	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe	27
PID 780 wrote to memory of 1900	780	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe	27
PID 780 wrote to memory of 976	780	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe	29
PID 780 wrote to memory of 976	780	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe	29
PID 780 wrote to memory of 976	780	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe	29
PID 780 wrote to memory of 976	780	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe	29
PID 780 wrote to memory of 976	780	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe	29
PID 780 wrote to memory of 976	780	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe	29
PID 780 wrote to memory of 976	780	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe	29
PID 780 wrote to memory of 976	780	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe	29
PID 780 wrote to memory of 976	780	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe	29
PID 780 wrote to memory of 976	780	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe	29
PID 780 wrote to memory of 976	780	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe	29
PID 780 wrote to memory of 976	780	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe	29
PID 976 wrote to memory of 1740	976	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe	30
PID 976 wrote to memory of 1740	976	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe	30
PID 976 wrote to memory of 1740	976	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe	30
PID 976 wrote to memory of 1740	976	SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe	30
PID 1740 wrote to memory of 1140	1740	Host.exe	31
PID 1740 wrote to memory of 1140	1740	Host.exe	31
PID 1740 wrote to memory of 1140	1740	Host.exe	31
PID 1740 wrote to memory of 1140	1740	Host.exe	31
PID 1740 wrote to memory of 1820	1740	Host.exe	33
PID 1740 wrote to memory of 1820	1740	Host.exe	33
PID 1740 wrote to memory of 1820	1740	Host.exe	33
PID 1740 wrote to memory of 1820	1740	Host.exe	33
PID 1740 wrote to memory of 1652	1740	Host.exe	34
PID 1740 wrote to memory of 1652	1740	Host.exe	34
PID 1740 wrote to memory of 1652	1740	Host.exe	34
PID 1740 wrote to memory of 1652	1740	Host.exe	34
PID 1740 wrote to memory of 1804	1740	Host.exe	35
PID 1740 wrote to memory of 1804	1740	Host.exe	35
PID 1740 wrote to memory of 1804	1740	Host.exe	35
PID 1740 wrote to memory of 1804	1740	Host.exe	35
PID 1740 wrote to memory of 1804	1740	Host.exe	35
PID 1740 wrote to memory of 1804	1740	Host.exe	35
PID 1740 wrote to memory of 1804	1740	Host.exe	35
PID 1740 wrote to memory of 1804	1740	Host.exe	35
PID 1740 wrote to memory of 1804	1740	Host.exe	35
PID 1740 wrote to memory of 1804	1740	Host.exe	35
PID 1740 wrote to memory of 1804	1740	Host.exe	35
PID 1740 wrote to memory of 1804	1740	Host.exe	35

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WeVSCisyy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1150.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1900
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe
  "{path}"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Users\Admin\AppData\Roaming\Install\Host.exe
    "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WeVSCisyy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9F7B.tmp"
      4⤵
      Creates scheduled task(s)
      PID:1140
  - - C:\Users\Admin\AppData\Roaming\Install\Host.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:1820
  - - C:\Users\Admin\AppData\Roaming\Install\Host.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:1652
  - - C:\Users\Admin\AppData\Roaming\Install\Host.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:1804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp1150.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp1150.tmp
Size 1KB
SHA256 46cb461a4b6d1dff5ed833c4279b732d875f0751d02e168d42fa3a15c29bba96
MD5 45150462cff7b85e750b56af370aa6ab
SHA1 e9f107bd899d0d37f5f06233edd2d58ea2c69d66
SHA512 f9ef68e062857213ba2f14c4a90263f86e74137dab3d83716f1ecf5ff38c7a5659942f5040b3b4334ea1bb801d6c5f25e27a828afc16e0cefa4e977adb2a0e24
MD5 SHA1 SHA512

Submit Download

tmp9F7B.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp9F7B.tmp
Size 1KB
SHA256 46cb461a4b6d1dff5ed833c4279b732d875f0751d02e168d42fa3a15c29bba96
MD5 45150462cff7b85e750b56af370aa6ab
SHA1 e9f107bd899d0d37f5f06233edd2d58ea2c69d66
SHA512 f9ef68e062857213ba2f14c4a90263f86e74137dab3d83716f1ecf5ff38c7a5659942f5040b3b4334ea1bb801d6c5f25e27a828afc16e0cefa4e977adb2a0e24
MD5 SHA1 SHA512

Submit Download

Host.exe

Path C:\Users\Admin\AppData\Roaming\Install\Host.exe
Size 779KB
SHA256 9e31da664bede9c4709cdbf2ec6a791dadc490cd30a67a3d2bbae42c7e9318ed
MD5 bec825008e3f4365a8a71961ba806f27
SHA1 a0f073d37901dd918af4e58f82a19e46479edc6b
SHA512 c251ee9de6053e57a0547f31b3469a6dc70619b6562c5345f3d76b8ffbc06b07c86749908f8eae1a7216a9c0c41eb1bbcc22318f6e5eefd6b1ee206c62be7526
SSDEEP 12288:osUf0eH06SolylSx1XqVlSyH0f67ajvKVl94tu1UNPuEz4YTLvNcMb4IoR55KFe:Xg3uSyUi7Iq9Z1UpuRMPoR5E
MD5 SHA1 SHA512 SSDEEP

Submit Download

Host.exe

Path C:\Users\Admin\AppData\Roaming\Install\Host.exe
Size 779KB
SHA256 9e31da664bede9c4709cdbf2ec6a791dadc490cd30a67a3d2bbae42c7e9318ed
MD5 bec825008e3f4365a8a71961ba806f27
SHA1 a0f073d37901dd918af4e58f82a19e46479edc6b
SHA512 c251ee9de6053e57a0547f31b3469a6dc70619b6562c5345f3d76b8ffbc06b07c86749908f8eae1a7216a9c0c41eb1bbcc22318f6e5eefd6b1ee206c62be7526
SSDEEP 12288:osUf0eH06SolylSx1XqVlSyH0f67ajvKVl94tu1UNPuEz4YTLvNcMb4IoR55KFe:Xg3uSyUi7Iq9Z1UpuRMPoR5E
MD5 SHA1 SHA512 SSDEEP

Submit Download

Host.exe

Path C:\Users\Admin\AppData\Roaming\Install\Host.exe
Size 779KB
SHA256 9e31da664bede9c4709cdbf2ec6a791dadc490cd30a67a3d2bbae42c7e9318ed
MD5 bec825008e3f4365a8a71961ba806f27
SHA1 a0f073d37901dd918af4e58f82a19e46479edc6b
SHA512 c251ee9de6053e57a0547f31b3469a6dc70619b6562c5345f3d76b8ffbc06b07c86749908f8eae1a7216a9c0c41eb1bbcc22318f6e5eefd6b1ee206c62be7526
SSDEEP 12288:osUf0eH06SolylSx1XqVlSyH0f67ajvKVl94tu1UNPuEz4YTLvNcMb4IoR55KFe:Xg3uSyUi7Iq9Z1UpuRMPoR5E
MD5 SHA1 SHA512 SSDEEP

Submit Download

Host.exe

Path C:\Users\Admin\AppData\Roaming\Install\Host.exe
Size 779KB
SHA256 9e31da664bede9c4709cdbf2ec6a791dadc490cd30a67a3d2bbae42c7e9318ed
MD5 bec825008e3f4365a8a71961ba806f27
SHA1 a0f073d37901dd918af4e58f82a19e46479edc6b
SHA512 c251ee9de6053e57a0547f31b3469a6dc70619b6562c5345f3d76b8ffbc06b07c86749908f8eae1a7216a9c0c41eb1bbcc22318f6e5eefd6b1ee206c62be7526
SSDEEP 12288:osUf0eH06SolylSx1XqVlSyH0f67ajvKVl94tu1UNPuEz4YTLvNcMb4IoR55KFe:Xg3uSyUi7Iq9Z1UpuRMPoR5E
MD5 SHA1 SHA512 SSDEEP

Submit Download

Host.exe

Path C:\Users\Admin\AppData\Roaming\Install\Host.exe
Size 779KB
SHA256 9e31da664bede9c4709cdbf2ec6a791dadc490cd30a67a3d2bbae42c7e9318ed
MD5 bec825008e3f4365a8a71961ba806f27
SHA1 a0f073d37901dd918af4e58f82a19e46479edc6b
SHA512 c251ee9de6053e57a0547f31b3469a6dc70619b6562c5345f3d76b8ffbc06b07c86749908f8eae1a7216a9c0c41eb1bbcc22318f6e5eefd6b1ee206c62be7526
SSDEEP 12288:osUf0eH06SolylSx1XqVlSyH0f67ajvKVl94tu1UNPuEz4YTLvNcMb4IoR55KFe:Xg3uSyUi7Iq9Z1UpuRMPoR5E
MD5 SHA1 SHA512 SSDEEP

Submit Download

Host.exe

Path \Users\Admin\AppData\Roaming\Install\Host.exe
Size 779KB
SHA256 9e31da664bede9c4709cdbf2ec6a791dadc490cd30a67a3d2bbae42c7e9318ed
MD5 bec825008e3f4365a8a71961ba806f27
SHA1 a0f073d37901dd918af4e58f82a19e46479edc6b
SHA512 c251ee9de6053e57a0547f31b3469a6dc70619b6562c5345f3d76b8ffbc06b07c86749908f8eae1a7216a9c0c41eb1bbcc22318f6e5eefd6b1ee206c62be7526
SSDEEP 12288:osUf0eH06SolylSx1XqVlSyH0f67ajvKVl94tu1UNPuEz4YTLvNcMb4IoR55KFe:Xg3uSyUi7Iq9Z1UpuRMPoR5E
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/780-58-0x0000000000D50000-0x0000000000D7E000-memory.dmp

Download

memory/780-54-0x0000000000FC0000-0x000000000108A000-memory.dmp

Download

memory/780-57-0x0000000005BA0000-0x0000000005C1E000-memory.dmp

Download

memory/780-56-0x0000000000310000-0x0000000000330000-memory.dmp

Download

memory/780-55-0x0000000076121000-0x0000000076123000-memory.dmp

Download

memory/976-61-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/976-62-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/976-75-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/976-70-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/976-76-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/976-71-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/976-68-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/976-67-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/976-64-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/976-66-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1740-81-0x0000000000260000-0x000000000032A000-memory.dmp

Download

memory/1804-102-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1804-103-0x0000000000400000-0x0000000000433000-memory.dmp

Download