netwire | fdf3f859ee5b8be0d6cda53c88e94d6b75b676e055102b828fc8106826f446ce

General

Target

SecuriteInfo.com.Win32.PWSX-gen.9061.exe
Size

666KB
MD5

bbd4d6df4dd680a7253bf7343292225e
SHA1

1b0dc36d3de872c4096b5a3bd93ef063fcf50ecb
SHA256

fdf3f859ee5b8be0d6cda53c88e94d6b75b676e055102b828fc8106826f446ce
SHA512

62881bb38c200dac57dfdbace7f7a3538ddf52f9c231d8afb3c92a4e7bfb69438a71174b1806687f01ed9a8136ae8e72e72e55b353ea36f4e1da40e9dc61a974
SSDEEP

12288:ibPil1JMpnl5GNFBxFLHHR0YrJWlylSx16FBzrAjmlyN+dq5ejjhLWfY:ib6lH6vOFBxFTdE

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

37.0.14.206:3384

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
true
offline_keylogger
true
password
Password234
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4432-140-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/4432-142-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/4432-146-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/3392-153-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/3392-154-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/3392-155-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

Host.exeHost.exe

pid process

404 Host.exe
3392 Host.exe

pid	process
404	Host.exe
3392	Host.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Host.exeSecuriteInfo.com.Win32.PWSX-gen.9061.exeSecuriteInfo.com.Win32.PWSX-gen.9061.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Host.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Win32.PWSX-gen.9061.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.9061.exeHost.exe

description	pid	process	target process
PID 4404 set thread context of 4432	4404	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 404 set thread context of 3392	404	Host.exe	Host.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2340 schtasks.exe
1544 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.9061.exeHost.exe

pid process

4404 SecuriteInfo.com.Win32.PWSX-gen.9061.exe
404 Host.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.9061.exeHost.exe

description pid process

Token: SeDebugPrivilege 4404 SecuriteInfo.com.Win32.PWSX-gen.9061.exe
Token: SeDebugPrivilege 404 Host.exe

pid	process
2340	schtasks.exe
1544	schtasks.exe

pid	process
4404	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
404	Host.exe

description	pid	process
Token: SeDebugPrivilege	4404	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
Token: SeDebugPrivilege	404	Host.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.9061.exeSecuriteInfo.com.Win32.PWSX-gen.9061.exeHost.exe

description	pid	process	target process
PID 4404 wrote to memory of 2340	4404	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	schtasks.exe
PID 4404 wrote to memory of 2340	4404	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	schtasks.exe
PID 4404 wrote to memory of 2340	4404	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	schtasks.exe
PID 4404 wrote to memory of 4432	4404	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 4404 wrote to memory of 4432	4404	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 4404 wrote to memory of 4432	4404	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 4404 wrote to memory of 4432	4404	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 4404 wrote to memory of 4432	4404	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 4404 wrote to memory of 4432	4404	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 4404 wrote to memory of 4432	4404	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 4404 wrote to memory of 4432	4404	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 4404 wrote to memory of 4432	4404	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 4404 wrote to memory of 4432	4404	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 4404 wrote to memory of 4432	4404	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	SecuriteInfo.com.Win32.PWSX-gen.9061.exe
PID 4432 wrote to memory of 404	4432	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	Host.exe
PID 4432 wrote to memory of 404	4432	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	Host.exe
PID 4432 wrote to memory of 404	4432	SecuriteInfo.com.Win32.PWSX-gen.9061.exe	Host.exe
PID 404 wrote to memory of 1544	404	Host.exe	schtasks.exe
PID 404 wrote to memory of 1544	404	Host.exe	schtasks.exe
PID 404 wrote to memory of 1544	404	Host.exe	schtasks.exe
PID 404 wrote to memory of 3392	404	Host.exe	Host.exe
PID 404 wrote to memory of 3392	404	Host.exe	Host.exe
PID 404 wrote to memory of 3392	404	Host.exe	Host.exe
PID 404 wrote to memory of 3392	404	Host.exe	Host.exe
PID 404 wrote to memory of 3392	404	Host.exe	Host.exe
PID 404 wrote to memory of 3392	404	Host.exe	Host.exe
PID 404 wrote to memory of 3392	404	Host.exe	Host.exe
PID 404 wrote to memory of 3392	404	Host.exe	Host.exe
PID 404 wrote to memory of 3392	404	Host.exe	Host.exe
PID 404 wrote to memory of 3392	404	Host.exe	Host.exe
PID 404 wrote to memory of 3392	404	Host.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9061.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9061.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4404

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UNyTzXTTIG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6A7.tmp"
2⤵
- Creates scheduled task(s)
PID:2340

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9061.exe
"{path}"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4432

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:404

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UNyTzXTTIG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8944.tmp"
4⤵
- Creates scheduled task(s)
PID:1544

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"{path}"
4⤵
- Executes dropped EXE
PID:3392

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6A7.tmp
Filesize
1KB

MD5
202fcb4767973271570a37092e3550c7

SHA1
6f376d436551642718ce84ed43b2ecd82e5c57ac

SHA256
533e1947fa7c429c7ba54d3f845fc43690ec34ca058ceb2591f03accd747b68e

SHA512
d0fd012992c3f4866e0836f521ca812b0470940e31bd70ac69406d08470371d5a3243cfcd56eb3b4143edff624a31794a26be535038a5ce4293e21e45a2aed0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8944.tmp
Filesize
1KB

MD5
202fcb4767973271570a37092e3550c7

SHA1
6f376d436551642718ce84ed43b2ecd82e5c57ac

SHA256
533e1947fa7c429c7ba54d3f845fc43690ec34ca058ceb2591f03accd747b68e

SHA512
d0fd012992c3f4866e0836f521ca812b0470940e31bd70ac69406d08470371d5a3243cfcd56eb3b4143edff624a31794a26be535038a5ce4293e21e45a2aed0b

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
666KB

MD5
bbd4d6df4dd680a7253bf7343292225e

SHA1
1b0dc36d3de872c4096b5a3bd93ef063fcf50ecb

SHA256
fdf3f859ee5b8be0d6cda53c88e94d6b75b676e055102b828fc8106826f446ce

SHA512
62881bb38c200dac57dfdbace7f7a3538ddf52f9c231d8afb3c92a4e7bfb69438a71174b1806687f01ed9a8136ae8e72e72e55b353ea36f4e1da40e9dc61a974

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
666KB

MD5
bbd4d6df4dd680a7253bf7343292225e

SHA1
1b0dc36d3de872c4096b5a3bd93ef063fcf50ecb

SHA256
fdf3f859ee5b8be0d6cda53c88e94d6b75b676e055102b828fc8106826f446ce

SHA512
62881bb38c200dac57dfdbace7f7a3538ddf52f9c231d8afb3c92a4e7bfb69438a71174b1806687f01ed9a8136ae8e72e72e55b353ea36f4e1da40e9dc61a974

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
666KB

MD5
bbd4d6df4dd680a7253bf7343292225e

SHA1
1b0dc36d3de872c4096b5a3bd93ef063fcf50ecb

SHA256
fdf3f859ee5b8be0d6cda53c88e94d6b75b676e055102b828fc8106826f446ce

SHA512
62881bb38c200dac57dfdbace7f7a3538ddf52f9c231d8afb3c92a4e7bfb69438a71174b1806687f01ed9a8136ae8e72e72e55b353ea36f4e1da40e9dc61a974

Download Submit
memory/404-143-0x0000000000000000-mapping.dmp

Download
memory/1544-147-0x0000000000000000-mapping.dmp

Download
memory/2340-137-0x0000000000000000-mapping.dmp

Download
memory/3392-155-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3392-154-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3392-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3392-149-0x0000000000000000-mapping.dmp

Download
memory/4404-134-0x0000000004FA0000-0x0000000005032000-memory.dmp

Filesize
584KB

Download
memory/4404-135-0x00000000051E0000-0x000000000527C000-memory.dmp

Filesize
624KB

Download
memory/4404-136-0x00000000051B0000-0x00000000051BA000-memory.dmp

Filesize
40KB

Download
memory/4404-132-0x0000000000560000-0x000000000060C000-memory.dmp

Filesize
688KB

Download
memory/4404-133-0x0000000005670000-0x0000000005C14000-memory.dmp

Filesize
5.6MB

Download
memory/4432-146-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4432-142-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4432-140-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4432-139-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads