netwire | 791d433a12cfde4d5c85addce8a00e4be6bb2d6e84d197a9c51c8567a6fb6f04

General

Target

791d433a12cfde4d5c85addce8a00e4be6bb2d6e84d197a9c51c8567a6fb6f04.exe
Size

1009KB
MD5

5924a435db94b857f47c1d8db535de0e
SHA1

9cb9c480ce6682e08789ee31209fbb6e663b5c76
SHA256

791d433a12cfde4d5c85addce8a00e4be6bb2d6e84d197a9c51c8567a6fb6f04
SHA512

e228b170c6c988ed07c0e9efee5b77142f4bcba05f0a148e8425eb80aa55e5e23c3aeb36009734f0ab16ad3ec1163598af76d54b3ee32c64bec9cf61a11a81cf
SSDEEP

24576:48GzoEgICYDQ1ne69fgPR5wq8YDw9sr8E9lcqWUIHn4QdEtJYv2T8aHEzcBU0kmM:SpQJfURqq8YDw9sr8E9lcqWUIHn4QdEG

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1584-60-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1584-61-0x0000000000150000-0x0000000000166000-memory.dmp	netwire
behavioral1/memory/1948-63-0x0000000000400000-0x0000000000506000-memory.dmp	netwire
behavioral1/memory/1948-64-0x0000000000400000-0x0000000000506000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

reader5.exe

pid process

1948 reader5.exe

pid	process
1948	reader5.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reader5.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3CQ67572-86I5-PVA1-3L36-228N40O2VBXT}	reader5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3CQ67572-86I5-PVA1-3L36-228N40O2VBXT}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\reader5.exe\""	reader5.exe

Loads dropped DLL 1 IoCs

Processes:

791d433a12cfde4d5c85addce8a00e4be6bb2d6e84d197a9c51c8567a6fb6f04.exe

pid process

1584 791d433a12cfde4d5c85addce8a00e4be6bb2d6e84d197a9c51c8567a6fb6f04.exe

pid	process
1584	791d433a12cfde4d5c85addce8a00e4be6bb2d6e84d197a9c51c8567a6fb6f04.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reader5.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	reader5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Acrobat4 = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\reader5.exe"	reader5.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

791d433a12cfde4d5c85addce8a00e4be6bb2d6e84d197a9c51c8567a6fb6f04.exereader5.exe

pid process

1584 791d433a12cfde4d5c85addce8a00e4be6bb2d6e84d197a9c51c8567a6fb6f04.exe
1948 reader5.exe

pid	process
1584	791d433a12cfde4d5c85addce8a00e4be6bb2d6e84d197a9c51c8567a6fb6f04.exe
1948	reader5.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

791d433a12cfde4d5c85addce8a00e4be6bb2d6e84d197a9c51c8567a6fb6f04.exe

description	pid	process	target process
PID 1584 wrote to memory of 1948	1584	791d433a12cfde4d5c85addce8a00e4be6bb2d6e84d197a9c51c8567a6fb6f04.exe	reader5.exe
PID 1584 wrote to memory of 1948	1584	791d433a12cfde4d5c85addce8a00e4be6bb2d6e84d197a9c51c8567a6fb6f04.exe	reader5.exe
PID 1584 wrote to memory of 1948	1584	791d433a12cfde4d5c85addce8a00e4be6bb2d6e84d197a9c51c8567a6fb6f04.exe	reader5.exe
PID 1584 wrote to memory of 1948	1584	791d433a12cfde4d5c85addce8a00e4be6bb2d6e84d197a9c51c8567a6fb6f04.exe	reader5.exe

C:\Users\Admin\AppData\Local\Temp\791d433a12cfde4d5c85addce8a00e4be6bb2d6e84d197a9c51c8567a6fb6f04.exe
"C:\Users\Admin\AppData\Local\Temp\791d433a12cfde4d5c85addce8a00e4be6bb2d6e84d197a9c51c8567a6fb6f04.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1584

C:\Users\Admin\AppData\Roaming\Install\reader5.exe
"C:\Users\Admin\AppData\Roaming\Install\reader5.exe"
2⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of UnmapMainImage
PID:1948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\reader5.exe

Filesize
1009KB

MD5
5924a435db94b857f47c1d8db535de0e

SHA1
9cb9c480ce6682e08789ee31209fbb6e663b5c76

SHA256
791d433a12cfde4d5c85addce8a00e4be6bb2d6e84d197a9c51c8567a6fb6f04

SHA512
e228b170c6c988ed07c0e9efee5b77142f4bcba05f0a148e8425eb80aa55e5e23c3aeb36009734f0ab16ad3ec1163598af76d54b3ee32c64bec9cf61a11a81cf

Download Submit
\Users\Admin\AppData\Roaming\Install\reader5.exe

Filesize
1009KB

MD5
5924a435db94b857f47c1d8db535de0e

SHA1
9cb9c480ce6682e08789ee31209fbb6e663b5c76

SHA256
791d433a12cfde4d5c85addce8a00e4be6bb2d6e84d197a9c51c8567a6fb6f04

SHA512
e228b170c6c988ed07c0e9efee5b77142f4bcba05f0a148e8425eb80aa55e5e23c3aeb36009734f0ab16ad3ec1163598af76d54b3ee32c64bec9cf61a11a81cf

Download Submit
memory/1584-54-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download
memory/1584-55-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/1584-60-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1584-61-0x0000000000150000-0x0000000000166000-memory.dmp

Filesize
88KB

Download
memory/1948-57-0x0000000000000000-mapping.dmp

Download
memory/1948-62-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/1948-63-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/1948-64-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads