netwire | 0b069c7e87aeb1802c8a83bf595bdf68040faf36bb5f607f4d1a20b8b8f45403

General

Target

proof of payment.exe
Size

661KB
MD5

af0b6c0b096bc0a9a6c6da19b3340a4c
SHA1

4bc68ca3cd282e9c711c6b9a452a425af4fdf8d8
SHA256

0b069c7e87aeb1802c8a83bf595bdf68040faf36bb5f607f4d1a20b8b8f45403
SHA512

b33da09ded4c519566e9277cc4b10c4f5553246dd587c74c6c212430b45d4c188221d65f4357a6a5ff97202e1429378dd903c7f23217a16acf876c0bf3ab0ba1
SSDEEP

12288:m5VF75e1ZsTyxRM2wfQy/FhucmJcTQJW0OkzKJfhd45/B:KVZ52ZX/OX9hDUcTOW5eAHW

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 7 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1752-69-0x0000000000400000-0x000000000042B000-memory.dmp	netwire
behavioral1/memory/1752-70-0x0000000000400000-0x000000000042B000-memory.dmp	netwire
behavioral1/memory/1752-72-0x0000000000400000-0x000000000042B000-memory.dmp	netwire
behavioral1/memory/1752-74-0x0000000000400000-0x000000000042B000-memory.dmp	netwire
behavioral1/memory/1752-75-0x00000000004026D0-mapping.dmp	netwire
behavioral1/memory/1752-78-0x0000000000400000-0x000000000042B000-memory.dmp	netwire
behavioral1/memory/1752-80-0x0000000000400000-0x000000000042B000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

proof of payment.exe

description pid process target process

PID 1992 set thread context of 1752 1992 proof of payment.exe proof of payment.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1448 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1232 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1232 powershell.exe

description	pid	process	target process
PID 1992 set thread context of 1752	1992	proof of payment.exe	proof of payment.exe

pid	process
1448	schtasks.exe

pid	process
1232	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1232	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

proof of payment.exe

description	pid	process	target process
PID 1992 wrote to memory of 1232	1992	proof of payment.exe	powershell.exe
PID 1992 wrote to memory of 1232	1992	proof of payment.exe	powershell.exe
PID 1992 wrote to memory of 1232	1992	proof of payment.exe	powershell.exe
PID 1992 wrote to memory of 1232	1992	proof of payment.exe	powershell.exe
PID 1992 wrote to memory of 1448	1992	proof of payment.exe	schtasks.exe
PID 1992 wrote to memory of 1448	1992	proof of payment.exe	schtasks.exe
PID 1992 wrote to memory of 1448	1992	proof of payment.exe	schtasks.exe
PID 1992 wrote to memory of 1448	1992	proof of payment.exe	schtasks.exe
PID 1992 wrote to memory of 1752	1992	proof of payment.exe	proof of payment.exe
PID 1992 wrote to memory of 1752	1992	proof of payment.exe	proof of payment.exe
PID 1992 wrote to memory of 1752	1992	proof of payment.exe	proof of payment.exe
PID 1992 wrote to memory of 1752	1992	proof of payment.exe	proof of payment.exe
PID 1992 wrote to memory of 1752	1992	proof of payment.exe	proof of payment.exe
PID 1992 wrote to memory of 1752	1992	proof of payment.exe	proof of payment.exe
PID 1992 wrote to memory of 1752	1992	proof of payment.exe	proof of payment.exe
PID 1992 wrote to memory of 1752	1992	proof of payment.exe	proof of payment.exe
PID 1992 wrote to memory of 1752	1992	proof of payment.exe	proof of payment.exe
PID 1992 wrote to memory of 1752	1992	proof of payment.exe	proof of payment.exe
PID 1992 wrote to memory of 1752	1992	proof of payment.exe	proof of payment.exe

C:\Users\Admin\AppData\Local\Temp\proof of payment.exe
"C:\Users\Admin\AppData\Local\Temp\proof of payment.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uVDXDtwcCw.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1232

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uVDXDtwcCw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp30A3.tmp"
2⤵
- Creates scheduled task(s)
PID:1448

C:\Users\Admin\AppData\Local\Temp\proof of payment.exe
"C:\Users\Admin\AppData\Local\Temp\proof of payment.exe"
2⤵
PID:1752

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp30A3.tmp
Filesize
1KB

MD5
b215e3625ce490e05e68acf4341487d8

SHA1
92321d2f51562bf6139aa6e28da8071cf24660f7

SHA256
d83b6279c176d78833cc722ca4bab17fbe9b5d32e8533bc85797d88c56046332

SHA512
d542a7fa5509740c979873f0af7ba2b2cad609b308cdeae1d9ec0f0d3398efe024ef93dc7c2d6f8e84189d7f706ea266da9be8c57d7e27d8508d3a27884c48c7

Download Submit
memory/1232-59-0x0000000000000000-mapping.dmp

Download
memory/1232-81-0x000000006F5C0000-0x000000006FB6B000-memory.dmp

Filesize
5.7MB

Download
memory/1232-79-0x000000006F5C0000-0x000000006FB6B000-memory.dmp

Filesize
5.7MB

Download
memory/1448-60-0x0000000000000000-mapping.dmp

Download
memory/1752-65-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1752-69-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1752-80-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1752-78-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1752-64-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1752-75-0x00000000004026D0-mapping.dmp

Download
memory/1752-67-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1752-74-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1752-70-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1752-72-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1992-58-0x0000000005EA0000-0x0000000005F20000-memory.dmp

Filesize
512KB

Download
memory/1992-54-0x0000000000BC0000-0x0000000000C6A000-memory.dmp

Filesize
680KB

Download
memory/1992-63-0x0000000004760000-0x0000000004786000-memory.dmp

Filesize
152KB

Download
memory/1992-56-0x0000000000540000-0x0000000000558000-memory.dmp

Filesize
96KB

Download
memory/1992-57-0x0000000000570000-0x000000000057C000-memory.dmp

Filesize
48KB

Download
memory/1992-55-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads