netwire | bf6a763be37b940d0ab0ca6d8d5cbba15366861f36acf4e98e4249f92f445e39

General

Target

bf6a763be37b940d0ab0ca6d8d5cbba15366861f36acf4e98e4249f92f445e39.exe
Size

194KB
MD5

668d157ae4a5f12573f9711d5c545c20
SHA1

ad7ff5f2fdb495a21c13656bb6ab8269b37b580e
SHA256

bf6a763be37b940d0ab0ca6d8d5cbba15366861f36acf4e98e4249f92f445e39
SHA512

245cd610ec06f30662b7be887f86b4b75f9c2947240837b7699df1a58301f4d2c6a1c2dbfea30a5df629f48a2eb11445bf0a638e4ad8a603069a8949a7f9735b
SSDEEP

3072:JjQONxHpxhA2H/hegAuhIR/M5eWsJzayw8zcXyNYCQk2eDwXJQ6p:ScHm2Y0hPeWKzayFzvCCvzSJQ

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\csc.exe"	reg.exe

NetWire RAT payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1284-62-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1284-64-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1284-65-0x00000000004021DA-mapping.dmp	netwire
behavioral1/memory/1284-68-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1284-69-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

Processes:

bf6a763be37b940d0ab0ca6d8d5cbba15366861f36acf4e98e4249f92f445e39.exe

description	pid	process	target process
PID 1988 set thread context of 1284	1988	bf6a763be37b940d0ab0ca6d8d5cbba15366861f36acf4e98e4249f92f445e39.exe	cvtres.exe

Drops file in Windows directory 2 IoCs

Processes:

cvtres.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier	cvtres.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier	cvtres.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

bf6a763be37b940d0ab0ca6d8d5cbba15366861f36acf4e98e4249f92f445e39.execmd.exe

description	pid	process	target process
PID 1988 wrote to memory of 1284	1988	bf6a763be37b940d0ab0ca6d8d5cbba15366861f36acf4e98e4249f92f445e39.exe	cvtres.exe
PID 1988 wrote to memory of 1284	1988	bf6a763be37b940d0ab0ca6d8d5cbba15366861f36acf4e98e4249f92f445e39.exe	cvtres.exe
PID 1988 wrote to memory of 1284	1988	bf6a763be37b940d0ab0ca6d8d5cbba15366861f36acf4e98e4249f92f445e39.exe	cvtres.exe
PID 1988 wrote to memory of 1284	1988	bf6a763be37b940d0ab0ca6d8d5cbba15366861f36acf4e98e4249f92f445e39.exe	cvtres.exe
PID 1988 wrote to memory of 1284	1988	bf6a763be37b940d0ab0ca6d8d5cbba15366861f36acf4e98e4249f92f445e39.exe	cvtres.exe
PID 1988 wrote to memory of 1284	1988	bf6a763be37b940d0ab0ca6d8d5cbba15366861f36acf4e98e4249f92f445e39.exe	cvtres.exe
PID 1988 wrote to memory of 1284	1988	bf6a763be37b940d0ab0ca6d8d5cbba15366861f36acf4e98e4249f92f445e39.exe	cvtres.exe
PID 1988 wrote to memory of 1284	1988	bf6a763be37b940d0ab0ca6d8d5cbba15366861f36acf4e98e4249f92f445e39.exe	cvtres.exe
PID 1988 wrote to memory of 1284	1988	bf6a763be37b940d0ab0ca6d8d5cbba15366861f36acf4e98e4249f92f445e39.exe	cvtres.exe
PID 1988 wrote to memory of 1792	1988	bf6a763be37b940d0ab0ca6d8d5cbba15366861f36acf4e98e4249f92f445e39.exe	cmd.exe
PID 1988 wrote to memory of 1792	1988	bf6a763be37b940d0ab0ca6d8d5cbba15366861f36acf4e98e4249f92f445e39.exe	cmd.exe
PID 1988 wrote to memory of 1792	1988	bf6a763be37b940d0ab0ca6d8d5cbba15366861f36acf4e98e4249f92f445e39.exe	cmd.exe
PID 1988 wrote to memory of 1792	1988	bf6a763be37b940d0ab0ca6d8d5cbba15366861f36acf4e98e4249f92f445e39.exe	cmd.exe
PID 1792 wrote to memory of 912	1792	cmd.exe	reg.exe
PID 1792 wrote to memory of 912	1792	cmd.exe	reg.exe
PID 1792 wrote to memory of 912	1792	cmd.exe	reg.exe
PID 1792 wrote to memory of 912	1792	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\bf6a763be37b940d0ab0ca6d8d5cbba15366861f36acf4e98e4249f92f445e39.exe
"C:\Users\Admin\AppData\Local\Temp\bf6a763be37b940d0ab0ca6d8d5cbba15366861f36acf4e98e4249f92f445e39.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
2⤵
- Drops file in Windows directory
PID:1284

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d explorer.exe,"C:\Users\Admin\AppData\Local\Temp\csc.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d explorer.exe,"C:\Users\Admin\AppData\Local\Temp\csc.exe"
3⤵
- Modifies WinLogon for persistence
PID:912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-71-0x0000000000000000-mapping.dmp

Download
memory/1284-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1284-57-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1284-58-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1284-60-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1284-64-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1284-65-0x00000000004021DA-mapping.dmp

Download
memory/1284-68-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1284-69-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1792-70-0x0000000000000000-mapping.dmp

Download
memory/1988-56-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/1988-54-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download
memory/1988-55-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads