netwire | 8dda840eccb53427037b3a06dd5f886c78e6e55fe69d96b256b05176e85172db

Analysis

max time kernel
151s
max time network
115s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 13:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

INV_0893.exe
Size

1.2MB
MD5

d23e1e317d68720216699e1c9e524a78
SHA1

76b58185f5aa824e5bafc589aaa6c228b341b239
SHA256

8dda840eccb53427037b3a06dd5f886c78e6e55fe69d96b256b05176e85172db
SHA512

38a7d77645a9b2eb2bb9ec05c0f0c561a23aecadc7b5206f30bb98aa6bd97722af6a7174e371576deb389f53d58836b501e5ef1acf35da285ff5469784b5b021
SSDEEP

24576:5AOcZgAgB9ZE+UDuAWGyrb1pUVgfMgLAWDXxo8FVCaWXZWcbISNY:zTAgBLUDqZ1+O3VokCp7U+Y

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

212.193.30.230:3363

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Password@2
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1544-68-0x0000000000410000-0x0000000000924000-memory.dmp	netwire
behavioral1/memory/1544-69-0x000000000041242D-mapping.dmp	netwire
behavioral1/memory/1544-73-0x0000000000410000-0x0000000000924000-memory.dmp	netwire
behavioral1/memory/1544-74-0x0000000000410000-0x0000000000924000-memory.dmp	netwire
behavioral1/memory/1544-75-0x0000000000410000-0x0000000000924000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

uvbdlqfvw.pifRegSvcs.exe

pid process

896 uvbdlqfvw.pif
1544 RegSvcs.exe
Loads dropped DLL 5 IoCs

Processes:

INV_0893.exeuvbdlqfvw.pif

pid process

1264 INV_0893.exe
1264 INV_0893.exe
1264 INV_0893.exe
1264 INV_0893.exe
896 uvbdlqfvw.pif

pid	process
1264	INV_0893.exe
1264	INV_0893.exe
1264	INV_0893.exe
1264	INV_0893.exe
896	uvbdlqfvw.pif

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

uvbdlqfvw.pif

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	uvbdlqfvw.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\1_102\\UVBDLQ~1.PIF C:\\Users\\Admin\\1_102\\FAEUPD~1.AFR"	uvbdlqfvw.pif

Suspicious use of SetThreadContext 1 IoCs

Processes:

uvbdlqfvw.pif

description pid process target process

PID 896 set thread context of 1544 896 uvbdlqfvw.pif RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 896 set thread context of 1544	896	uvbdlqfvw.pif	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

uvbdlqfvw.pif

pid	process
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif
896	uvbdlqfvw.pif

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

INV_0893.exeuvbdlqfvw.pif

description	pid	process	target process
PID 1264 wrote to memory of 896	1264	INV_0893.exe	uvbdlqfvw.pif
PID 1264 wrote to memory of 896	1264	INV_0893.exe	uvbdlqfvw.pif
PID 1264 wrote to memory of 896	1264	INV_0893.exe	uvbdlqfvw.pif
PID 1264 wrote to memory of 896	1264	INV_0893.exe	uvbdlqfvw.pif
PID 1264 wrote to memory of 896	1264	INV_0893.exe	uvbdlqfvw.pif
PID 1264 wrote to memory of 896	1264	INV_0893.exe	uvbdlqfvw.pif
PID 1264 wrote to memory of 896	1264	INV_0893.exe	uvbdlqfvw.pif
PID 896 wrote to memory of 1544	896	uvbdlqfvw.pif	RegSvcs.exe
PID 896 wrote to memory of 1544	896	uvbdlqfvw.pif	RegSvcs.exe
PID 896 wrote to memory of 1544	896	uvbdlqfvw.pif	RegSvcs.exe
PID 896 wrote to memory of 1544	896	uvbdlqfvw.pif	RegSvcs.exe
PID 896 wrote to memory of 1544	896	uvbdlqfvw.pif	RegSvcs.exe
PID 896 wrote to memory of 1544	896	uvbdlqfvw.pif	RegSvcs.exe
PID 896 wrote to memory of 1544	896	uvbdlqfvw.pif	RegSvcs.exe
PID 896 wrote to memory of 1544	896	uvbdlqfvw.pif	RegSvcs.exe
PID 896 wrote to memory of 1544	896	uvbdlqfvw.pif	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\INV_0893.exe
"C:\Users\Admin\AppData\Local\Temp\INV_0893.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1264

C:\Users\Admin\1_102\uvbdlqfvw.pif
"C:\Users\Admin\1_102\uvbdlqfvw.pif" faeupdrjbw.afr
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:896

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
3⤵
- Executes dropped EXE
PID:1544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\1_102\faeupdrjbw.afr

Filesize
170.9MB

MD5
effba2d361bf03eca0d7b874614a995a

SHA1
df02fafbc0864975b8e55cd7ff3ec75bcfbe5212

SHA256
ca4eefbee52dfb136b739ed8c49265c620e61956acf85fd6e4735d0347700c01

SHA512
b2e35bb21df6b1362f051ae24f1e8f534e77ca8ccf6cfaa17c54a4137e1547031c3273a117b127b465c04596f8d5edd47c36bd5532c19f0534df41ef0fb00104

Download Submit
C:\Users\Admin\1_102\junnhus.tbg

Filesize
323KB

MD5
eb1ccd9ad7c05d6f77e14f488a7ecd7b

SHA1
2d3b3d67fc34052680419279308e93ecabc2f0f5

SHA256
9c6be7508c3de7d4502f32f167129ac5ecdaa2a8a83825cd1826110b5551cf2e

SHA512
6f37dcefaa02d82ed509a441486dffb3fd148a8958b97c405b13075577774af8678be07a8bf86d38b6c9268b6337bf773d84d80c244348cc90538bd196c302d5

Download Submit
C:\Users\Admin\1_102\qdmmn.ppt

Filesize
51KB

MD5
b7a0a87bbcc941bec34fd8acdcdd077a

SHA1
8c0c9adb7b9e1806aa4c49811fa4a2794490c645

SHA256
650e29ad1c2a6b951ee4868a5b1d350c8938e942e1796d7a48e52e8f93cabfda

SHA512
830604c84b91dc9012e094f20bf76ebf81acd6e85825c4481290e81def2d18b281c132a4ba817d9cf3fd43a5f5c62a0b40a557b176e8e94a2dca146c0651f2c3

Download Submit
C:\Users\Admin\1_102\uvbdlqfvw.pif

Filesize
906KB

MD5
f28aa08788132e64db4b8918ee2430b1

SHA1
ef32b1023a89dc36d7c5e98e22845fe87c5efef2

SHA256
f99b9fc041c177f0bee2c82d09f451ef0833696111b1b37cbfff8c975232ece2

SHA512
689cf6118061aa9e7d4b78118db99338aa767433df511610d471a989825a84a53119310248ed3870b10e48e77b47c429ef5a276dbc9c4ec53a7588e16093b50f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Filesize
44KB

MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
\Users\Admin\1_102\uvbdlqfvw.pif

Filesize
906KB

MD5
f28aa08788132e64db4b8918ee2430b1

SHA1
ef32b1023a89dc36d7c5e98e22845fe87c5efef2

SHA256
f99b9fc041c177f0bee2c82d09f451ef0833696111b1b37cbfff8c975232ece2

SHA512
689cf6118061aa9e7d4b78118db99338aa767433df511610d471a989825a84a53119310248ed3870b10e48e77b47c429ef5a276dbc9c4ec53a7588e16093b50f

Download Submit
\Users\Admin\1_102\uvbdlqfvw.pif

Filesize
906KB

MD5
f28aa08788132e64db4b8918ee2430b1

SHA1
ef32b1023a89dc36d7c5e98e22845fe87c5efef2

SHA256
f99b9fc041c177f0bee2c82d09f451ef0833696111b1b37cbfff8c975232ece2

SHA512
689cf6118061aa9e7d4b78118db99338aa767433df511610d471a989825a84a53119310248ed3870b10e48e77b47c429ef5a276dbc9c4ec53a7588e16093b50f

Download Submit
\Users\Admin\1_102\uvbdlqfvw.pif

Filesize
906KB

MD5
f28aa08788132e64db4b8918ee2430b1

SHA1
ef32b1023a89dc36d7c5e98e22845fe87c5efef2

SHA256
f99b9fc041c177f0bee2c82d09f451ef0833696111b1b37cbfff8c975232ece2

SHA512
689cf6118061aa9e7d4b78118db99338aa767433df511610d471a989825a84a53119310248ed3870b10e48e77b47c429ef5a276dbc9c4ec53a7588e16093b50f

Download Submit
\Users\Admin\1_102\uvbdlqfvw.pif

Filesize
906KB

MD5
f28aa08788132e64db4b8918ee2430b1

SHA1
ef32b1023a89dc36d7c5e98e22845fe87c5efef2

SHA256
f99b9fc041c177f0bee2c82d09f451ef0833696111b1b37cbfff8c975232ece2

SHA512
689cf6118061aa9e7d4b78118db99338aa767433df511610d471a989825a84a53119310248ed3870b10e48e77b47c429ef5a276dbc9c4ec53a7588e16093b50f

Download Submit
\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Filesize
44KB

MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
memory/896-59-0x0000000000000000-mapping.dmp

Download
memory/1264-54-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download
memory/1544-66-0x0000000000410000-0x0000000000924000-memory.dmp

Filesize
5.1MB

Download
memory/1544-68-0x0000000000410000-0x0000000000924000-memory.dmp

Filesize
5.1MB

Download
memory/1544-69-0x000000000041242D-mapping.dmp

Download
memory/1544-73-0x0000000000410000-0x0000000000924000-memory.dmp

Filesize
5.1MB

Download
memory/1544-74-0x0000000000410000-0x0000000000924000-memory.dmp

Filesize
5.1MB

Download
memory/1544-75-0x0000000000410000-0x0000000000924000-memory.dmp

Filesize
5.1MB

Download