netwire | 53944a881741bee915b91916abf91bb7916f89756ee49dc2bc8e8ba768213c16

General

Target

SecuriteInfo.com.Win32.RATX-gen.16112.exe
Size

837KB
MD5

380c39c11c790386e3b2babd5baf81ba
SHA1

6d52d56fe2623bdbb52b80426f70d090ccb2550c
SHA256

53944a881741bee915b91916abf91bb7916f89756ee49dc2bc8e8ba768213c16
SHA512

35cdb67daac5fefc4395743f2ba3160bdd1b089afb0797f79b2c3ba1718eae6cf678dcb099f5512674c0dd7778910e17a1637027fcc3413267cb833b3359de46
SSDEEP

12288:FDHgwwaiA/XwycRRSBDjIgZ7ChF9Dr+xTBIkoRmL1OpiBcdwO:CwAA/Xwy867wn2xTBIkoRE4

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

212.193.29.37:3030

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
client
install_path
%AppData%\Install\Host.exe
lock_executable
false
mutex
xcCpnqVL
offline_keylogger
false
password
123456
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 9 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3608-140-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/3608-141-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/3608-142-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/3608-143-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/3608-147-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/2436-151-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/2436-152-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/2436-153-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/2436-154-0x0000000000400000-0x0000000000450000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

Host.exeHost.exe

pid process

4092 Host.exe
2436 Host.exe

pid	process
4092	Host.exe
2436	Host.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SecuriteInfo.com.Win32.RATX-gen.16112.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Win32.RATX-gen.16112.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7È›ït5]1_BX×…—“ = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe"	Host.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

SecuriteInfo.com.Win32.RATX-gen.16112.exeHost.exe

description	pid	process	target process
PID 4816 set thread context of 3608	4816	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 4092 set thread context of 2436	4092	Host.exe	Host.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SecuriteInfo.com.Win32.RATX-gen.16112.exe

pid process

4816 SecuriteInfo.com.Win32.RATX-gen.16112.exe
4816 SecuriteInfo.com.Win32.RATX-gen.16112.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SecuriteInfo.com.Win32.RATX-gen.16112.exe

description pid process

Token: SeDebugPrivilege 4816 SecuriteInfo.com.Win32.RATX-gen.16112.exe

pid	process
4816	SecuriteInfo.com.Win32.RATX-gen.16112.exe
4816	SecuriteInfo.com.Win32.RATX-gen.16112.exe

description	pid	process
Token: SeDebugPrivilege	4816	SecuriteInfo.com.Win32.RATX-gen.16112.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

SecuriteInfo.com.Win32.RATX-gen.16112.exeSecuriteInfo.com.Win32.RATX-gen.16112.exeHost.exe

description	pid	process	target process
PID 4816 wrote to memory of 2000	4816	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 4816 wrote to memory of 2000	4816	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 4816 wrote to memory of 2000	4816	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 4816 wrote to memory of 3608	4816	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 4816 wrote to memory of 3608	4816	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 4816 wrote to memory of 3608	4816	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 4816 wrote to memory of 3608	4816	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 4816 wrote to memory of 3608	4816	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 4816 wrote to memory of 3608	4816	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 4816 wrote to memory of 3608	4816	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 4816 wrote to memory of 3608	4816	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 4816 wrote to memory of 3608	4816	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 4816 wrote to memory of 3608	4816	SecuriteInfo.com.Win32.RATX-gen.16112.exe	SecuriteInfo.com.Win32.RATX-gen.16112.exe
PID 3608 wrote to memory of 4092	3608	SecuriteInfo.com.Win32.RATX-gen.16112.exe	Host.exe
PID 3608 wrote to memory of 4092	3608	SecuriteInfo.com.Win32.RATX-gen.16112.exe	Host.exe
PID 3608 wrote to memory of 4092	3608	SecuriteInfo.com.Win32.RATX-gen.16112.exe	Host.exe
PID 4092 wrote to memory of 2436	4092	Host.exe	Host.exe
PID 4092 wrote to memory of 2436	4092	Host.exe	Host.exe
PID 4092 wrote to memory of 2436	4092	Host.exe	Host.exe
PID 4092 wrote to memory of 2436	4092	Host.exe	Host.exe
PID 4092 wrote to memory of 2436	4092	Host.exe	Host.exe
PID 4092 wrote to memory of 2436	4092	Host.exe	Host.exe
PID 4092 wrote to memory of 2436	4092	Host.exe	Host.exe
PID 4092 wrote to memory of 2436	4092	Host.exe	Host.exe
PID 4092 wrote to memory of 2436	4092	Host.exe	Host.exe
PID 4092 wrote to memory of 2436	4092	Host.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.16112.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.16112.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.16112.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.16112.exe"
2⤵
PID:2000

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.16112.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.16112.exe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3608

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4092

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2436

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
837KB

MD5
380c39c11c790386e3b2babd5baf81ba

SHA1
6d52d56fe2623bdbb52b80426f70d090ccb2550c

SHA256
53944a881741bee915b91916abf91bb7916f89756ee49dc2bc8e8ba768213c16

SHA512
35cdb67daac5fefc4395743f2ba3160bdd1b089afb0797f79b2c3ba1718eae6cf678dcb099f5512674c0dd7778910e17a1637027fcc3413267cb833b3359de46

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
837KB

MD5
380c39c11c790386e3b2babd5baf81ba

SHA1
6d52d56fe2623bdbb52b80426f70d090ccb2550c

SHA256
53944a881741bee915b91916abf91bb7916f89756ee49dc2bc8e8ba768213c16

SHA512
35cdb67daac5fefc4395743f2ba3160bdd1b089afb0797f79b2c3ba1718eae6cf678dcb099f5512674c0dd7778910e17a1637027fcc3413267cb833b3359de46

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
837KB

MD5
380c39c11c790386e3b2babd5baf81ba

SHA1
6d52d56fe2623bdbb52b80426f70d090ccb2550c

SHA256
53944a881741bee915b91916abf91bb7916f89756ee49dc2bc8e8ba768213c16

SHA512
35cdb67daac5fefc4395743f2ba3160bdd1b089afb0797f79b2c3ba1718eae6cf678dcb099f5512674c0dd7778910e17a1637027fcc3413267cb833b3359de46

Download Submit
memory/2000-138-0x0000000000000000-mapping.dmp

Download
memory/2436-154-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2436-153-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2436-152-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2436-151-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2436-148-0x0000000000000000-mapping.dmp

Download
memory/3608-147-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3608-142-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3608-143-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3608-141-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3608-140-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3608-139-0x0000000000000000-mapping.dmp

Download
memory/4092-144-0x0000000000000000-mapping.dmp

Download
memory/4816-132-0x0000000000C80000-0x0000000000D58000-memory.dmp

Filesize
864KB

Download
memory/4816-137-0x00000000091F0000-0x0000000009256000-memory.dmp

Filesize
408KB

Download
memory/4816-136-0x00000000090E0000-0x000000000917C000-memory.dmp

Filesize
624KB

Download
memory/4816-135-0x00000000056F0000-0x00000000056FA000-memory.dmp

Filesize
40KB

Download
memory/4816-134-0x00000000057D0000-0x0000000005862000-memory.dmp

Filesize
584KB

Download
memory/4816-133-0x0000000005D80000-0x0000000006324000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads