netwire | 888e73dd8c2651b8da9e04a8521d1d82c312c3d59860df4dc18cbacbbc3f31af

General

Target

Quote_PDF.js
Size

416KB
MD5

00d505983f81b198c0e96550cdfc665e
SHA1

c8e5ab47efb9cda85683fcc808ea02677ea27441
SHA256

888e73dd8c2651b8da9e04a8521d1d82c312c3d59860df4dc18cbacbbc3f31af
SHA512

7b15a4da4d0571979d0c9f25308dd48f2cc15637de7cbc52a481fb3baf25a4d96c1cd3bbcc9928166ea41419cc72166ee053ddae85618ff8412c0ce9c79ce504
SSDEEP

6144:XWfS/GKH18Vhwsm8JWhz660+O3qamLA6cuZPrX5Enr24XenZ7TAJo3uO:XWfiNcJWhz65z3q+6c+PTG67d

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/files/0x0003000000000725-135.dat	netwire
behavioral2/files/0x0003000000000725-136.dat	netwire
behavioral2/files/0x000300000000072b-139.dat	netwire
behavioral2/files/0x000300000000072b-138.dat	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Executes dropped EXE 2 IoCs

pid	Process
3252	Host Ip 185.216.71.251.exe
5080	Note.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Host Ip 185.216.71.251.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Notepad.lnk	Note.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Note.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\)Ô‡OûPN»t@÷áh = "C:\\Users\\Admin\\AppData\\Roaming\\Gooogle\\Note.exe"	Note.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 3032	4188	wscript.exe	81
PID 4188 wrote to memory of 3032	4188	wscript.exe	81
PID 4188 wrote to memory of 3252	4188	wscript.exe	82
PID 4188 wrote to memory of 3252	4188	wscript.exe	82
PID 4188 wrote to memory of 3252	4188	wscript.exe	82
PID 3252 wrote to memory of 5080	3252	Host Ip 185.216.71.251.exe	83
PID 3252 wrote to memory of 5080	3252	Host Ip 185.216.71.251.exe	83
PID 3252 wrote to memory of 5080	3252	Host Ip 185.216.71.251.exe	83

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Quote_PDF.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\kJcrNvTGLP.js"
  2⤵
  PID:3032
- C:\Users\Admin\AppData\Roaming\Host Ip 185.216.71.251.exe
  "C:\Users\Admin\AppData\Roaming\Host Ip 185.216.71.251.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Users\Admin\AppData\Roaming\Gooogle\Note.exe
    "C:\Users\Admin\AppData\Roaming\Gooogle\Note.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Adds Run key to start application
    PID:5080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Gooogle\Note.exe

Filesize
227KB

MD5
a8edd52c5edfe91da90ebee24b51d3c6

SHA1
fc36350b93c6974865eaa7f00a98fa281d1ff7fd

SHA256
35d0bbb6787ae3fb3e155f2eaad36e5f4bb5255e7bb95b759790cc3cc048839d

SHA512
97278bb3967c6ec10d221820d0d50d3582e6fd3975318c882efbecc6b87bfc83f9f58d927e81ecb95ea8a510929591834a27a23e56dc38e8d091f95f9a31ca14

Download Submit
C:\Users\Admin\AppData\Roaming\Gooogle\Note.exe

Filesize
227KB

MD5
a8edd52c5edfe91da90ebee24b51d3c6

SHA1
fc36350b93c6974865eaa7f00a98fa281d1ff7fd

SHA256
35d0bbb6787ae3fb3e155f2eaad36e5f4bb5255e7bb95b759790cc3cc048839d

SHA512
97278bb3967c6ec10d221820d0d50d3582e6fd3975318c882efbecc6b87bfc83f9f58d927e81ecb95ea8a510929591834a27a23e56dc38e8d091f95f9a31ca14

Download Submit
C:\Users\Admin\AppData\Roaming\Host Ip 185.216.71.251.exe

Filesize
227KB

MD5
a8edd52c5edfe91da90ebee24b51d3c6

SHA1
fc36350b93c6974865eaa7f00a98fa281d1ff7fd

SHA256
35d0bbb6787ae3fb3e155f2eaad36e5f4bb5255e7bb95b759790cc3cc048839d

SHA512
97278bb3967c6ec10d221820d0d50d3582e6fd3975318c882efbecc6b87bfc83f9f58d927e81ecb95ea8a510929591834a27a23e56dc38e8d091f95f9a31ca14

Download Submit
C:\Users\Admin\AppData\Roaming\Host Ip 185.216.71.251.exe

Filesize
227KB

MD5
a8edd52c5edfe91da90ebee24b51d3c6

SHA1
fc36350b93c6974865eaa7f00a98fa281d1ff7fd

SHA256
35d0bbb6787ae3fb3e155f2eaad36e5f4bb5255e7bb95b759790cc3cc048839d

SHA512
97278bb3967c6ec10d221820d0d50d3582e6fd3975318c882efbecc6b87bfc83f9f58d927e81ecb95ea8a510929591834a27a23e56dc38e8d091f95f9a31ca14

Download Submit
C:\Users\Admin\AppData\Roaming\kJcrNvTGLP.js

Filesize
3KB

MD5
d29a81dca145e2c8e4fe0cd841c7f0b1

SHA1
40ddc0481967acd0a6ef243588b4040aa2628c0c

SHA256
9617cedbeac15fa6287ee42ff30557d2edbae5b85267be757c368dcce56a9cf8

SHA512
8e7a7b676abcd163b7cead6440c614098977460abc61f257cf410f70e0b6ae87bfd8ee64bba29df78e11bcfbb39b0c639c61f2b676b07d817d02f181cf51e7e7

Download Submit

Analysis

Sharing