netwire | 849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

General

Target

doc.exe
Size

882KB
MD5

95b5d76bfb2204011333248cc121b5a4
SHA1

6faea7983c34f12cec7d22184be0eb1693e0abaf
SHA256

849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e
SHA512

966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152
SSDEEP

12288:eP9sJ2iNZrmsAJVSsuTEa0nKYVNp1X8bX+r9k3RADqjJ5n5OiU0rZIG41r5XiXoT:ePiJ1rasmLNaGKgNb8+rEjr5G

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

37.0.14.206:3384

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
true
offline_keylogger
true
password
Password234
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4312-140-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/4312-142-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/4312-146-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/4408-155-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/4408-156-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/4408-157-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 3 IoCs

Processes:

Host.exeHost.exeHost.exe

pid process

2880 Host.exe
4972 Host.exe
4408 Host.exe

pid	process
2880	Host.exe
4972	Host.exe
4408	Host.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

doc.exedoc.exeHost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	doc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	doc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Host.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

doc.exeHost.exe

description pid process target process

PID 4788 set thread context of 4312 4788 doc.exe doc.exe
PID 2880 set thread context of 4408 2880 Host.exe Host.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2240 schtasks.exe
4592 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

doc.exeHost.exe

pid process

4788 doc.exe
2880 Host.exe
2880 Host.exe
2880 Host.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

doc.exeHost.exe

description pid process

Token: SeDebugPrivilege 4788 doc.exe
Token: SeDebugPrivilege 2880 Host.exe

description	pid	process	target process
PID 4788 set thread context of 4312	4788	doc.exe	doc.exe
PID 2880 set thread context of 4408	2880	Host.exe	Host.exe

pid	process
2240	schtasks.exe
4592	schtasks.exe

pid	process
4788	doc.exe
2880	Host.exe
2880	Host.exe
2880	Host.exe

description	pid	process
Token: SeDebugPrivilege	4788	doc.exe
Token: SeDebugPrivilege	2880	Host.exe

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

doc.exedoc.exeHost.exe

description	pid	process	target process
PID 4788 wrote to memory of 2240	4788	doc.exe	schtasks.exe
PID 4788 wrote to memory of 2240	4788	doc.exe	schtasks.exe
PID 4788 wrote to memory of 2240	4788	doc.exe	schtasks.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4312 wrote to memory of 2880	4312	doc.exe	Host.exe
PID 4312 wrote to memory of 2880	4312	doc.exe	Host.exe
PID 4312 wrote to memory of 2880	4312	doc.exe	Host.exe
PID 2880 wrote to memory of 4592	2880	Host.exe	schtasks.exe
PID 2880 wrote to memory of 4592	2880	Host.exe	schtasks.exe
PID 2880 wrote to memory of 4592	2880	Host.exe	schtasks.exe
PID 2880 wrote to memory of 4972	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4972	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4972	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\doc.exe
"C:\Users\Admin\AppData\Local\Temp\doc.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NksNHqr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5890.tmp"
2⤵
- Creates scheduled task(s)
PID:2240

C:\Users\Admin\AppData\Local\Temp\doc.exe
"{path}"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4312

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NksNHqr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC5A2.tmp"
4⤵
- Creates scheduled task(s)
PID:4592

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"{path}"
4⤵
- Executes dropped EXE
PID:4972

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"{path}"
4⤵
- Executes dropped EXE
PID:4408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5890.tmp

Filesize
1KB

MD5
8bd18c65571655407e9122d3099d8330

SHA1
54e26b7b31c985196e170708dd19f8b0572c2f35

SHA256
8ee3a0a1727c6a7a7e0075e33db373b0532433116cdd1aa62b7208fcc4d83a13

SHA512
30582cf3c526d2f3fd88bbdb820ab6e77aff4f46c7328771a7904f16684e36390cc108c7ca9c0a5e1af001d474b9749629c5396c432b99d40d0ad39625bf6274

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC5A2.tmp

Filesize
1KB

MD5
8bd18c65571655407e9122d3099d8330

SHA1
54e26b7b31c985196e170708dd19f8b0572c2f35

SHA256
8ee3a0a1727c6a7a7e0075e33db373b0532433116cdd1aa62b7208fcc4d83a13

SHA512
30582cf3c526d2f3fd88bbdb820ab6e77aff4f46c7328771a7904f16684e36390cc108c7ca9c0a5e1af001d474b9749629c5396c432b99d40d0ad39625bf6274

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
882KB

MD5
95b5d76bfb2204011333248cc121b5a4

SHA1
6faea7983c34f12cec7d22184be0eb1693e0abaf

SHA256
849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

SHA512
966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
882KB

MD5
95b5d76bfb2204011333248cc121b5a4

SHA1
6faea7983c34f12cec7d22184be0eb1693e0abaf

SHA256
849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

SHA512
966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
882KB

MD5
95b5d76bfb2204011333248cc121b5a4

SHA1
6faea7983c34f12cec7d22184be0eb1693e0abaf

SHA256
849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

SHA512
966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
882KB

MD5
95b5d76bfb2204011333248cc121b5a4

SHA1
6faea7983c34f12cec7d22184be0eb1693e0abaf

SHA256
849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

SHA512
966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

Download Submit
memory/2240-137-0x0000000000000000-mapping.dmp

Download
memory/2880-143-0x0000000000000000-mapping.dmp

Download
memory/4312-140-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4312-142-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4312-146-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4312-139-0x0000000000000000-mapping.dmp

Download
memory/4408-151-0x0000000000000000-mapping.dmp

Download
memory/4408-157-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4408-156-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4408-155-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4592-147-0x0000000000000000-mapping.dmp

Download
memory/4788-135-0x00000000054F0000-0x000000000558C000-memory.dmp

Filesize
624KB

Download
memory/4788-134-0x0000000005450000-0x00000000054E2000-memory.dmp

Filesize
584KB

Download
memory/4788-133-0x0000000005960000-0x0000000005F04000-memory.dmp

Filesize
5.6MB

Download
memory/4788-136-0x0000000005430000-0x000000000543A000-memory.dmp

Filesize
40KB

Download
memory/4788-132-0x0000000000960000-0x0000000000A42000-memory.dmp

Filesize
904KB

Download
memory/4972-149-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads