netwire | ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f

General

Target

ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe
Size

180KB
MD5

68f609243235a5fe05c8d09c2989c410
SHA1

dc1e833195e3d5fcb75fd2ae08195e50214e2b2b
SHA256

ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f
SHA512

eca5631c4d4ce400504c44a03d5a207feb838789392fac76f3aea610bfd1c1f3c3c25f1ca2c9bb980755717150ac333f310a2d5fc3258d120dbb9f172278c773
SSDEEP

3072:bUF02lOqHxRAS4QILWOkuU2xoh0lhS8zzyLA:bbqRGZNWn92xo

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1164-59-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1164-57-0x0000000000000000-mapping.dmp	netwire
behavioral1/memory/1164-61-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1164-62-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{COECS0BW-5CW7-5OW8-2CV3-21EL7UK327A1}	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{COECS0BW-5CW7-5OW8-2CV3-21EL7UK327A1}\StubPath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe\""	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe"	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe

pid process

1736 ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe

pid	process
1736	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe

C:\Users\Admin\AppData\Local\Temp\ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe
"C:\Users\Admin\AppData\Local\Temp\ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736

C:\Users\Admin\AppData\Local\Temp\ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe
"C:\Users\Admin\AppData\Local\Temp\ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe"
2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:1164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1164-59-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1164-57-0x0000000000000000-mapping.dmp

Download
memory/1164-61-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1164-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1736-56-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1736-58-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download

description	pid	process	target process
PID 1736 wrote to memory of 1164	1736	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe
PID 1736 wrote to memory of 1164	1736	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe
PID 1736 wrote to memory of 1164	1736	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe
PID 1736 wrote to memory of 1164	1736	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe
PID 1736 wrote to memory of 1164	1736	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe
PID 1736 wrote to memory of 1164	1736	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe
PID 1736 wrote to memory of 1164	1736	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe
PID 1736 wrote to memory of 1164	1736	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe
PID 1736 wrote to memory of 1164	1736	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe
PID 1736 wrote to memory of 1164	1736	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe
PID 1736 wrote to memory of 1164	1736	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe
PID 1736 wrote to memory of 1164	1736	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe
PID 1736 wrote to memory of 1164	1736	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe
PID 1736 wrote to memory of 1164	1736	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe
PID 1736 wrote to memory of 1164	1736	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe
PID 1736 wrote to memory of 1164	1736	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe	ec11b4049fd82dfe920b0a409ff1739488fc2993bb4362b2f7b8fc7491a80a6f.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads