netwire | fdf3f859ee5b8be0d6cda53c88e94d6b75b676e055102b828fc8106826f446ce

General

Target

SecuriteInfo.com.Win32.PWSX-gen.9061.exe
Size

666KB
MD5

bbd4d6df4dd680a7253bf7343292225e
SHA1

1b0dc36d3de872c4096b5a3bd93ef063fcf50ecb
SHA256

fdf3f859ee5b8be0d6cda53c88e94d6b75b676e055102b828fc8106826f446ce
SHA512

62881bb38c200dac57dfdbace7f7a3538ddf52f9c231d8afb3c92a4e7bfb69438a71174b1806687f01ed9a8136ae8e72e72e55b353ea36f4e1da40e9dc61a974
SSDEEP

12288:ibPil1JMpnl5GNFBxFLHHR0YrJWlylSx16FBzrAjmlyN+dq5ejjhLWfY:ib6lH6vOFBxFTdE

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

37.0.14.206:3384

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
true
offline_keylogger
true
password
Password234
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 11 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1568-66-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1568-67-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1568-68-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1568-70-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1568-71-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1568-72-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1568-75-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1568-79-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1780-96-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1780-100-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1780-101-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

Host.exeHost.exe

pid process

1692 Host.exe
1780 Host.exe
Loads dropped DLL 1 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.9061.exe

pid process

1568 SecuriteInfo.com.Win32.PWSX-gen.9061.exe

pid	process
1692	Host.exe
1780	Host.exe

pid	process
1568	SecuriteInfo.com.Win32.PWSX-gen.9061.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.9061.exeHost.exe

description	pid	process	target process
PID 1280 set thread context of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 1692 set thread context of 1780	1692	Host.exe	Host.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

536 schtasks.exe
1544 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.9061.exeHost.exe

pid process

1280 SecuriteInfo.com.Win32.PWSX-gen.9061.exe
1692 Host.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.9061.exeHost.exe

description pid process

Token: SeDebugPrivilege 1280 SecuriteInfo.com.Win32.PWSX-gen.9061.exe
Token: SeDebugPrivilege 1692 Host.exe

pid	process
536	schtasks.exe
1544	schtasks.exe

pid	process
1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
1692	Host.exe

description	pid	process
Token: SeDebugPrivilege	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
Token: SeDebugPrivilege	1692	Host.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.9061.exeSecuriteInfo.com.Win32.PWSX-gen.9061.exeHost.exe

description	pid	process	target process
PID 1280 wrote to memory of 536	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	schtasks.exe
PID 1280 wrote to memory of 536	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	schtasks.exe
PID 1280 wrote to memory of 536	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	schtasks.exe
PID 1280 wrote to memory of 536	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	schtasks.exe
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 1568 wrote to memory of 1692	1568	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	Host.exe
PID 1568 wrote to memory of 1692	1568	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	Host.exe
PID 1568 wrote to memory of 1692	1568	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	Host.exe
PID 1568 wrote to memory of 1692	1568	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	Host.exe
PID 1692 wrote to memory of 1544	1692	Host.exe	schtasks.exe
PID 1692 wrote to memory of 1544	1692	Host.exe	schtasks.exe
PID 1692 wrote to memory of 1544	1692	Host.exe	schtasks.exe
PID 1692 wrote to memory of 1544	1692	Host.exe	schtasks.exe
PID 1692 wrote to memory of 1780	1692	Host.exe	Host.exe
PID 1692 wrote to memory of 1780	1692	Host.exe	Host.exe
PID 1692 wrote to memory of 1780	1692	Host.exe	Host.exe
PID 1692 wrote to memory of 1780	1692	Host.exe	Host.exe
PID 1692 wrote to memory of 1780	1692	Host.exe	Host.exe
PID 1692 wrote to memory of 1780	1692	Host.exe	Host.exe
PID 1692 wrote to memory of 1780	1692	Host.exe	Host.exe
PID 1692 wrote to memory of 1780	1692	Host.exe	Host.exe
PID 1692 wrote to memory of 1780	1692	Host.exe	Host.exe
PID 1692 wrote to memory of 1780	1692	Host.exe	Host.exe
PID 1692 wrote to memory of 1780	1692	Host.exe	Host.exe
PID 1692 wrote to memory of 1780	1692	Host.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9061.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9061.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UNyTzXTTIG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB4EE.tmp"
2⤵
- Creates scheduled task(s)
PID:536

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9061.exe
"{path}"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1568

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UNyTzXTTIG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp71E6.tmp"
4⤵
- Creates scheduled task(s)
PID:1544

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"{path}"
4⤵
- Executes dropped EXE
PID:1780

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp71E6.tmp
Filesize
1KB

MD5
997d38d59294a7b94a2c87c663c1ecf0

SHA1
ca76ac4bb83ae5484ea358fdc731cd72a5303f8f

SHA256
7d3d27b45522f6eb970a813d991791ba2a9f5d19ea6eb346ff4e27bf67ca6994

SHA512
7a03bf26a6c310b9672b367f5c1c01a669527b4f5cf86c664bfa5e414eebc94b1a95c2cc4e57ad2973f53fcbd3bfe205b480739ac849173110fcf0b345595bbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB4EE.tmp
Filesize
1KB

MD5
997d38d59294a7b94a2c87c663c1ecf0

SHA1
ca76ac4bb83ae5484ea358fdc731cd72a5303f8f

SHA256
7d3d27b45522f6eb970a813d991791ba2a9f5d19ea6eb346ff4e27bf67ca6994

SHA512
7a03bf26a6c310b9672b367f5c1c01a669527b4f5cf86c664bfa5e414eebc94b1a95c2cc4e57ad2973f53fcbd3bfe205b480739ac849173110fcf0b345595bbb

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
666KB

MD5
bbd4d6df4dd680a7253bf7343292225e

SHA1
1b0dc36d3de872c4096b5a3bd93ef063fcf50ecb

SHA256
fdf3f859ee5b8be0d6cda53c88e94d6b75b676e055102b828fc8106826f446ce

SHA512
62881bb38c200dac57dfdbace7f7a3538ddf52f9c231d8afb3c92a4e7bfb69438a71174b1806687f01ed9a8136ae8e72e72e55b353ea36f4e1da40e9dc61a974

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
666KB

MD5
bbd4d6df4dd680a7253bf7343292225e

SHA1
1b0dc36d3de872c4096b5a3bd93ef063fcf50ecb

SHA256
fdf3f859ee5b8be0d6cda53c88e94d6b75b676e055102b828fc8106826f446ce

SHA512
62881bb38c200dac57dfdbace7f7a3538ddf52f9c231d8afb3c92a4e7bfb69438a71174b1806687f01ed9a8136ae8e72e72e55b353ea36f4e1da40e9dc61a974

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
666KB

MD5
bbd4d6df4dd680a7253bf7343292225e

SHA1
1b0dc36d3de872c4096b5a3bd93ef063fcf50ecb

SHA256
fdf3f859ee5b8be0d6cda53c88e94d6b75b676e055102b828fc8106826f446ce

SHA512
62881bb38c200dac57dfdbace7f7a3538ddf52f9c231d8afb3c92a4e7bfb69438a71174b1806687f01ed9a8136ae8e72e72e55b353ea36f4e1da40e9dc61a974

Download Submit
\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
666KB

MD5
bbd4d6df4dd680a7253bf7343292225e

SHA1
1b0dc36d3de872c4096b5a3bd93ef063fcf50ecb

SHA256
fdf3f859ee5b8be0d6cda53c88e94d6b75b676e055102b828fc8106826f446ce

SHA512
62881bb38c200dac57dfdbace7f7a3538ddf52f9c231d8afb3c92a4e7bfb69438a71174b1806687f01ed9a8136ae8e72e72e55b353ea36f4e1da40e9dc61a974

Download Submit
memory/536-59-0x0000000000000000-mapping.dmp

Download
memory/1280-57-0x0000000004CB0000-0x0000000004D2C000-memory.dmp

Filesize
496KB

Download
memory/1280-58-0x00000000009B0000-0x00000000009DE000-memory.dmp

Filesize
184KB

Download
memory/1280-54-0x0000000001110000-0x00000000011BC000-memory.dmp

Filesize
688KB

Download
memory/1280-56-0x00000000003C0000-0x00000000003E0000-memory.dmp

Filesize
128KB

Download
memory/1280-55-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1544-83-0x0000000000000000-mapping.dmp

Download
memory/1568-71-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1568-79-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1568-72-0x000000000040242D-mapping.dmp

Download
memory/1568-75-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1568-68-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1568-61-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1568-67-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1568-70-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1568-62-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1568-66-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1568-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1692-81-0x00000000011F0000-0x000000000129C000-memory.dmp

Filesize
688KB

Download
memory/1692-77-0x0000000000000000-mapping.dmp

Download
memory/1780-96-0x000000000040242D-mapping.dmp

Download
memory/1780-100-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1780-101-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads