netwire | 53944a881741bee915b91916abf91bb7916f89756ee49dc2bc8e8ba768213c16

General

Target

SecuriteInfo.com.Win32.RATX-gen.16112.exe
Size

837KB
MD5

380c39c11c790386e3b2babd5baf81ba
SHA1

6d52d56fe2623bdbb52b80426f70d090ccb2550c
SHA256

53944a881741bee915b91916abf91bb7916f89756ee49dc2bc8e8ba768213c16
SHA512

35cdb67daac5fefc4395743f2ba3160bdd1b089afb0797f79b2c3ba1718eae6cf678dcb099f5512674c0dd7778910e17a1637027fcc3413267cb833b3359de46
SSDEEP

12288:FDHgwwaiA/XwycRRSBDjIgZ7ChF9Dr+xTBIkoRmL1OpiBcdwO:CwAA/Xwy867wn2xTBIkoRE4

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

212.193.29.37:3030

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
client
install_path
%AppData%\Install\Host.exe
lock_executable
false
mutex
xcCpnqVL
offline_keylogger
false
password
123456
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 12 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1680-65-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1680-67-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1680-68-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1680-70-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1680-71-0x000000000041AE7B-mapping.dmp	netwire
behavioral1/memory/1680-74-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1680-75-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1680-80-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/900-97-0x000000000041AE7B-mapping.dmp	netwire
behavioral1/memory/900-101-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/900-102-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/900-103-0x0000000000400000-0x0000000000450000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 4 IoCs

Processes:

Host.exeHost.exeHost.exeHost.exe

pid process

904 Host.exe
728 Host.exe
1640 Host.exe
900 Host.exe
Loads dropped DLL 2 IoCs

Processes:

SecuriteInfo.com.Win32.RATX-gen.16112.exe

pid process

1680 SecuriteInfo.com.Win32.RATX-gen.16112.exe
1680 SecuriteInfo.com.Win32.RATX-gen.16112.exe

pid	process
904	Host.exe
728	Host.exe
1640	Host.exe
900	Host.exe

pid	process
1680	SecuriteInfo.com.Win32.RATX-gen.16112.exe
1680	SecuriteInfo.com.Win32.RATX-gen.16112.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\7È›ït5]1_BX×…—“ = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe"	Host.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

SecuriteInfo.com.Win32.RATX-gen.16112.exeHost.exe

description	pid	process	target process
PID 1384 set thread context of 1680	1384	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 904 set thread context of 900	904	Host.exe	Host.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Host.exe

pid process

904 Host.exe
904 Host.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Host.exe

description pid process

Token: SeDebugPrivilege 904 Host.exe

pid	process
904	Host.exe
904	Host.exe

description	pid	process
Token: SeDebugPrivilege	904	Host.exe

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

SecuriteInfo.com.Win32.RATX-gen.16112.exeSecuriteInfo.com.Win32.RATX-gen.16112.exeHost.exe

description	pid	process	target process
PID 1384 wrote to memory of 1680	1384	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 1384 wrote to memory of 1680	1384	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 1384 wrote to memory of 1680	1384	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 1384 wrote to memory of 1680	1384	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 1384 wrote to memory of 1680	1384	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 1384 wrote to memory of 1680	1384	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 1384 wrote to memory of 1680	1384	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 1384 wrote to memory of 1680	1384	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 1384 wrote to memory of 1680	1384	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 1384 wrote to memory of 1680	1384	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 1384 wrote to memory of 1680	1384	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 1680 wrote to memory of 904	1680	SecuriteInfo.com.Win32.RATX-gen.16112.exe	Host.exe
PID 1680 wrote to memory of 904	1680	SecuriteInfo.com.Win32.RATX-gen.16112.exe	Host.exe
PID 1680 wrote to memory of 904	1680	SecuriteInfo.com.Win32.RATX-gen.16112.exe	Host.exe
PID 1680 wrote to memory of 904	1680	SecuriteInfo.com.Win32.RATX-gen.16112.exe	Host.exe
PID 904 wrote to memory of 728	904	Host.exe	Host.exe
PID 904 wrote to memory of 728	904	Host.exe	Host.exe
PID 904 wrote to memory of 728	904	Host.exe	Host.exe
PID 904 wrote to memory of 728	904	Host.exe	Host.exe
PID 904 wrote to memory of 1640	904	Host.exe	Host.exe
PID 904 wrote to memory of 1640	904	Host.exe	Host.exe
PID 904 wrote to memory of 1640	904	Host.exe	Host.exe
PID 904 wrote to memory of 1640	904	Host.exe	Host.exe
PID 904 wrote to memory of 900	904	Host.exe	Host.exe
PID 904 wrote to memory of 900	904	Host.exe	Host.exe
PID 904 wrote to memory of 900	904	Host.exe	Host.exe
PID 904 wrote to memory of 900	904	Host.exe	Host.exe
PID 904 wrote to memory of 900	904	Host.exe	Host.exe
PID 904 wrote to memory of 900	904	Host.exe	Host.exe
PID 904 wrote to memory of 900	904	Host.exe	Host.exe
PID 904 wrote to memory of 900	904	Host.exe	Host.exe
PID 904 wrote to memory of 900	904	Host.exe	Host.exe
PID 904 wrote to memory of 900	904	Host.exe	Host.exe
PID 904 wrote to memory of 900	904	Host.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.16112.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.16112.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1384

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.16112.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.16112.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1680

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:904

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
4⤵
- Executes dropped EXE
PID:728

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
4⤵
- Executes dropped EXE
PID:1640

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:900

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
837KB

MD5
380c39c11c790386e3b2babd5baf81ba

SHA1
6d52d56fe2623bdbb52b80426f70d090ccb2550c

SHA256
53944a881741bee915b91916abf91bb7916f89756ee49dc2bc8e8ba768213c16

SHA512
35cdb67daac5fefc4395743f2ba3160bdd1b089afb0797f79b2c3ba1718eae6cf678dcb099f5512674c0dd7778910e17a1637027fcc3413267cb833b3359de46

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
837KB

MD5
380c39c11c790386e3b2babd5baf81ba

SHA1
6d52d56fe2623bdbb52b80426f70d090ccb2550c

SHA256
53944a881741bee915b91916abf91bb7916f89756ee49dc2bc8e8ba768213c16

SHA512
35cdb67daac5fefc4395743f2ba3160bdd1b089afb0797f79b2c3ba1718eae6cf678dcb099f5512674c0dd7778910e17a1637027fcc3413267cb833b3359de46

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
837KB

MD5
380c39c11c790386e3b2babd5baf81ba

SHA1
6d52d56fe2623bdbb52b80426f70d090ccb2550c

SHA256
53944a881741bee915b91916abf91bb7916f89756ee49dc2bc8e8ba768213c16

SHA512
35cdb67daac5fefc4395743f2ba3160bdd1b089afb0797f79b2c3ba1718eae6cf678dcb099f5512674c0dd7778910e17a1637027fcc3413267cb833b3359de46

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
837KB

MD5
380c39c11c790386e3b2babd5baf81ba

SHA1
6d52d56fe2623bdbb52b80426f70d090ccb2550c

SHA256
53944a881741bee915b91916abf91bb7916f89756ee49dc2bc8e8ba768213c16

SHA512
35cdb67daac5fefc4395743f2ba3160bdd1b089afb0797f79b2c3ba1718eae6cf678dcb099f5512674c0dd7778910e17a1637027fcc3413267cb833b3359de46

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
837KB

MD5
380c39c11c790386e3b2babd5baf81ba

SHA1
6d52d56fe2623bdbb52b80426f70d090ccb2550c

SHA256
53944a881741bee915b91916abf91bb7916f89756ee49dc2bc8e8ba768213c16

SHA512
35cdb67daac5fefc4395743f2ba3160bdd1b089afb0797f79b2c3ba1718eae6cf678dcb099f5512674c0dd7778910e17a1637027fcc3413267cb833b3359de46

Download Submit
\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
837KB

MD5
380c39c11c790386e3b2babd5baf81ba

SHA1
6d52d56fe2623bdbb52b80426f70d090ccb2550c

SHA256
53944a881741bee915b91916abf91bb7916f89756ee49dc2bc8e8ba768213c16

SHA512
35cdb67daac5fefc4395743f2ba3160bdd1b089afb0797f79b2c3ba1718eae6cf678dcb099f5512674c0dd7778910e17a1637027fcc3413267cb833b3359de46

Download Submit
\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
837KB

MD5
380c39c11c790386e3b2babd5baf81ba

SHA1
6d52d56fe2623bdbb52b80426f70d090ccb2550c

SHA256
53944a881741bee915b91916abf91bb7916f89756ee49dc2bc8e8ba768213c16

SHA512
35cdb67daac5fefc4395743f2ba3160bdd1b089afb0797f79b2c3ba1718eae6cf678dcb099f5512674c0dd7778910e17a1637027fcc3413267cb833b3359de46

Download Submit
memory/900-102-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/900-101-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/900-103-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/900-97-0x000000000041AE7B-mapping.dmp

Download
memory/904-82-0x0000000000270000-0x0000000000348000-memory.dmp

Filesize
864KB

Download
memory/904-78-0x0000000000000000-mapping.dmp

Download
memory/1384-54-0x0000000000F70000-0x0000000001048000-memory.dmp

Filesize
864KB

Download
memory/1384-59-0x0000000000EB0000-0x0000000000EFA000-memory.dmp

Filesize
296KB

Download
memory/1384-58-0x0000000007CB0000-0x0000000007D54000-memory.dmp

Filesize
656KB

Download
memory/1384-57-0x00000000003D0000-0x00000000003DC000-memory.dmp

Filesize
48KB

Download
memory/1384-56-0x00000000003C0000-0x00000000003D4000-memory.dmp

Filesize
80KB

Download
memory/1384-55-0x0000000076701000-0x0000000076703000-memory.dmp

Filesize
8KB

Download
memory/1680-61-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1680-80-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1680-75-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1680-74-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1680-71-0x000000000041AE7B-mapping.dmp

Download
memory/1680-70-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1680-68-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1680-67-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1680-65-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1680-63-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1680-60-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads