netwire | fdf3f859ee5b8be0d6cda53c88e94d6b75b676e055102b828fc8106826f446ce

Analysis

max time kernel
96s
max time network
126s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/09/2022, 15:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.PWSX-gen.9061.exe
Size 666KB
Sample220906-s9blhacfcm
SHA256 fdf3f859ee5b8be0d6cda53c88e94d6b75b676e055102b828fc8106826f446ce
MD5 bbd4d6df4dd680a7253bf7343292225e
SHA1 1b0dc36d3de872c4096b5a3bd93ef063fcf50ecb
SHA512 62881bb38c200dac57dfdbace7f7a3538ddf52f9c231d8afb3c92a4e7bfb69438a71174b1806687f01ed9a8136ae8e72e72e55b353ea36f4e1da40e9dc61a974
SSDEEP 12288:ibPil1JMpnl5GNFBxFLHHR0YrJWlylSx16FBzrAjmlyN+dq5ejjhLWfY:ib6lH6vOFBxFTdE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

37.0.14.206:3384

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
true
offline_keylogger
true
password
Password234
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 11 IoCs

rat

resource	yara_rule
behavioral1/memory/1568-66-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1568-67-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1568-68-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1568-70-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1568-71-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1568-72-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1568-75-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1568-79-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1780-96-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1780-100-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1780-101-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Executes dropped EXE 2 IoCs

pid	Process
1692	Host.exe
1780	Host.exe

Loads dropped DLL 1 IoCs

pid	Process
1568	SecuriteInfo.com.Win32.PWSX-gen.9061.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1280 set thread context of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	29
PID 1692 set thread context of 1780	1692	Host.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
536	schtasks.exe
1544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
1692	Host.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
Token: SeDebugPrivilege	1692	Host.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 536	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	27
PID 1280 wrote to memory of 536	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	27
PID 1280 wrote to memory of 536	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	27
PID 1280 wrote to memory of 536	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	27
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	29
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	29
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	29
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	29
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	29
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	29
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	29
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	29
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	29
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	29
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	29
PID 1280 wrote to memory of 1568	1280	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	29
PID 1568 wrote to memory of 1692	1568	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	30
PID 1568 wrote to memory of 1692	1568	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	30
PID 1568 wrote to memory of 1692	1568	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	30
PID 1568 wrote to memory of 1692	1568	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	30
PID 1692 wrote to memory of 1544	1692	Host.exe	31
PID 1692 wrote to memory of 1544	1692	Host.exe	31
PID 1692 wrote to memory of 1544	1692	Host.exe	31
PID 1692 wrote to memory of 1544	1692	Host.exe	31
PID 1692 wrote to memory of 1780	1692	Host.exe	33
PID 1692 wrote to memory of 1780	1692	Host.exe	33
PID 1692 wrote to memory of 1780	1692	Host.exe	33
PID 1692 wrote to memory of 1780	1692	Host.exe	33
PID 1692 wrote to memory of 1780	1692	Host.exe	33
PID 1692 wrote to memory of 1780	1692	Host.exe	33
PID 1692 wrote to memory of 1780	1692	Host.exe	33
PID 1692 wrote to memory of 1780	1692	Host.exe	33
PID 1692 wrote to memory of 1780	1692	Host.exe	33
PID 1692 wrote to memory of 1780	1692	Host.exe	33
PID 1692 wrote to memory of 1780	1692	Host.exe	33
PID 1692 wrote to memory of 1780	1692	Host.exe	33

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9061.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9061.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UNyTzXTTIG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB4EE.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:536
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9061.exe
  "{path}"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Users\Admin\AppData\Roaming\Install\Host.exe
    "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UNyTzXTTIG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp71E6.tmp"
      4⤵
      Creates scheduled task(s)
      PID:1544
  - - C:\Users\Admin\AppData\Roaming\Install\Host.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:1780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp71E6.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp71E6.tmp
Size 1KB
SHA256 7d3d27b45522f6eb970a813d991791ba2a9f5d19ea6eb346ff4e27bf67ca6994
MD5 997d38d59294a7b94a2c87c663c1ecf0
SHA1 ca76ac4bb83ae5484ea358fdc731cd72a5303f8f
SHA512 7a03bf26a6c310b9672b367f5c1c01a669527b4f5cf86c664bfa5e414eebc94b1a95c2cc4e57ad2973f53fcbd3bfe205b480739ac849173110fcf0b345595bbb
MD5 SHA1 SHA512

Submit Download

tmpB4EE.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpB4EE.tmp
Size 1KB
SHA256 7d3d27b45522f6eb970a813d991791ba2a9f5d19ea6eb346ff4e27bf67ca6994
MD5 997d38d59294a7b94a2c87c663c1ecf0
SHA1 ca76ac4bb83ae5484ea358fdc731cd72a5303f8f
SHA512 7a03bf26a6c310b9672b367f5c1c01a669527b4f5cf86c664bfa5e414eebc94b1a95c2cc4e57ad2973f53fcbd3bfe205b480739ac849173110fcf0b345595bbb
MD5 SHA1 SHA512

Submit Download

Host.exe

Path C:\Users\Admin\AppData\Roaming\Install\Host.exe
Size 666KB
SHA256 fdf3f859ee5b8be0d6cda53c88e94d6b75b676e055102b828fc8106826f446ce
MD5 bbd4d6df4dd680a7253bf7343292225e
SHA1 1b0dc36d3de872c4096b5a3bd93ef063fcf50ecb
SHA512 62881bb38c200dac57dfdbace7f7a3538ddf52f9c231d8afb3c92a4e7bfb69438a71174b1806687f01ed9a8136ae8e72e72e55b353ea36f4e1da40e9dc61a974
SSDEEP 12288:ibPil1JMpnl5GNFBxFLHHR0YrJWlylSx16FBzrAjmlyN+dq5ejjhLWfY:ib6lH6vOFBxFTdE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Host.exe

Path C:\Users\Admin\AppData\Roaming\Install\Host.exe
Size 666KB
SHA256 fdf3f859ee5b8be0d6cda53c88e94d6b75b676e055102b828fc8106826f446ce
MD5 bbd4d6df4dd680a7253bf7343292225e
SHA1 1b0dc36d3de872c4096b5a3bd93ef063fcf50ecb
SHA512 62881bb38c200dac57dfdbace7f7a3538ddf52f9c231d8afb3c92a4e7bfb69438a71174b1806687f01ed9a8136ae8e72e72e55b353ea36f4e1da40e9dc61a974
SSDEEP 12288:ibPil1JMpnl5GNFBxFLHHR0YrJWlylSx16FBzrAjmlyN+dq5ejjhLWfY:ib6lH6vOFBxFTdE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Host.exe

Path C:\Users\Admin\AppData\Roaming\Install\Host.exe
Size 666KB
SHA256 fdf3f859ee5b8be0d6cda53c88e94d6b75b676e055102b828fc8106826f446ce
MD5 bbd4d6df4dd680a7253bf7343292225e
SHA1 1b0dc36d3de872c4096b5a3bd93ef063fcf50ecb
SHA512 62881bb38c200dac57dfdbace7f7a3538ddf52f9c231d8afb3c92a4e7bfb69438a71174b1806687f01ed9a8136ae8e72e72e55b353ea36f4e1da40e9dc61a974
SSDEEP 12288:ibPil1JMpnl5GNFBxFLHHR0YrJWlylSx16FBzrAjmlyN+dq5ejjhLWfY:ib6lH6vOFBxFTdE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Host.exe

Path \Users\Admin\AppData\Roaming\Install\Host.exe
Size 666KB
SHA256 fdf3f859ee5b8be0d6cda53c88e94d6b75b676e055102b828fc8106826f446ce
MD5 bbd4d6df4dd680a7253bf7343292225e
SHA1 1b0dc36d3de872c4096b5a3bd93ef063fcf50ecb
SHA512 62881bb38c200dac57dfdbace7f7a3538ddf52f9c231d8afb3c92a4e7bfb69438a71174b1806687f01ed9a8136ae8e72e72e55b353ea36f4e1da40e9dc61a974
SSDEEP 12288:ibPil1JMpnl5GNFBxFLHHR0YrJWlylSx16FBzrAjmlyN+dq5ejjhLWfY:ib6lH6vOFBxFTdE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1280-57-0x0000000004CB0000-0x0000000004D2C000-memory.dmp

Download

memory/1280-58-0x00000000009B0000-0x00000000009DE000-memory.dmp

Download

memory/1280-54-0x0000000001110000-0x00000000011BC000-memory.dmp

Download

memory/1280-56-0x00000000003C0000-0x00000000003E0000-memory.dmp

Download

memory/1280-55-0x0000000075601000-0x0000000075603000-memory.dmp

Download

memory/1568-71-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1568-79-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1568-75-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1568-68-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1568-61-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1568-67-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1568-70-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1568-62-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1568-66-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1568-64-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1692-81-0x00000000011F0000-0x000000000129C000-memory.dmp

Download

memory/1780-100-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1780-101-0x0000000000400000-0x0000000000433000-memory.dmp

Download