netwire | 8a339775bd331c2bac7f1e0152dbdd6d8037ef2098a6b455b1cce45107cb5e6e

General

Target

Remittance AdviceInvoice and parking List pdf.exe
Size

1.0MB
MD5

ce1250f42f8fa8bc70082cf2b591c471
SHA1

70a550c5d3ed62257fd1dfd9213a99444104d69b
SHA256

8a339775bd331c2bac7f1e0152dbdd6d8037ef2098a6b455b1cce45107cb5e6e
SHA512

187c386f97562b7fd84467ff3bc4865d84a0ba7d14f3266ca0423a9574908e5bfeda7d14d739686b7e0d90e61abafcc9943fa62c081ac59decd463a45180e4cb
SSDEEP

12288:O2iNzJLbODG3PnKgGtW07tZMtQ/VP/281jPRSPCfdrXPm3u:O1fukPnvt0ZZ4Q/VP/28OPCN+3

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

kimlee11.duckdns.org:8839

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
lock_executable
false
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/900-69-0x0000000000400000-0x000000000044F000-memory.dmp	netwire
behavioral1/memory/900-72-0x0000000000400000-0x000000000044F000-memory.dmp	netwire
behavioral1/memory/900-71-0x0000000000400000-0x000000000044F000-memory.dmp	netwire
behavioral1/memory/900-74-0x0000000000400000-0x000000000044F000-memory.dmp	netwire
behavioral1/memory/900-75-0x000000000041AD7B-mapping.dmp	netwire
behavioral1/memory/900-78-0x0000000000400000-0x000000000044F000-memory.dmp	netwire
behavioral1/memory/900-79-0x0000000000400000-0x000000000044F000-memory.dmp	netwire
behavioral1/memory/900-82-0x0000000000400000-0x000000000044F000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

Processes:

Remittance AdviceInvoice and parking List pdf.exe

description	pid	process	target process
PID 2044 set thread context of 900	2044	Remittance AdviceInvoice and parking List pdf.exe	Remittance AdviceInvoice and parking List pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1392 schtasks.exe

pid	process
1392	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

Remittance AdviceInvoice and parking List pdf.exepowershell.exe

pid	process
2044	Remittance AdviceInvoice and parking List pdf.exe
2044	Remittance AdviceInvoice and parking List pdf.exe
2044	Remittance AdviceInvoice and parking List pdf.exe
2044	Remittance AdviceInvoice and parking List pdf.exe
2044	Remittance AdviceInvoice and parking List pdf.exe
2044	Remittance AdviceInvoice and parking List pdf.exe
2044	Remittance AdviceInvoice and parking List pdf.exe
1540	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Remittance AdviceInvoice and parking List pdf.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2044 Remittance AdviceInvoice and parking List pdf.exe
Token: SeDebugPrivilege 1540 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2044	Remittance AdviceInvoice and parking List pdf.exe
Token: SeDebugPrivilege	1540	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

Remittance AdviceInvoice and parking List pdf.exe

C:\Users\Admin\AppData\Local\Temp\Remittance AdviceInvoice and parking List pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Remittance AdviceInvoice and parking List pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ATtzwttIOonXlr.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ATtzwttIOonXlr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3035.tmp"
2⤵
- Creates scheduled task(s)
PID:1392

C:\Users\Admin\AppData\Local\Temp\Remittance AdviceInvoice and parking List pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Remittance AdviceInvoice and parking List pdf.exe"
2⤵
PID:524

C:\Users\Admin\AppData\Local\Temp\Remittance AdviceInvoice and parking List pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Remittance AdviceInvoice and parking List pdf.exe"
2⤵
PID:900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3035.tmp

Filesize
1KB

MD5
04132162fb16e98606b726cadfc5e315

SHA1
1e390335fcce78d9957884a2e0980ff3791a5472

SHA256
027d53202f16c95bfab17c0dab81b22b1250e0d331195a563eca116e1234d674

SHA512
9b04fc137c88ecf1793bb41412eb671d83e7c437efb3bf0cec074c35ccdc735c55e209e2ceac985177398574e826380fc78d1f9d439dc0f7784da6d0c5505e16

Download Submit
memory/900-74-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/900-71-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/900-67-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/900-72-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/900-69-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/900-82-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/900-79-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/900-64-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/900-65-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/900-78-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/900-75-0x000000000041AD7B-mapping.dmp

Download
memory/1392-60-0x0000000000000000-mapping.dmp

Download
memory/1540-59-0x0000000000000000-mapping.dmp

Download
memory/1540-80-0x000000006EF60000-0x000000006F50B000-memory.dmp

Filesize
5.7MB

Download
memory/1540-81-0x000000006EF60000-0x000000006F50B000-memory.dmp

Filesize
5.7MB

Download
memory/2044-58-0x0000000005CE0000-0x0000000005D86000-memory.dmp

Filesize
664KB

Download
memory/2044-54-0x0000000001300000-0x0000000001406000-memory.dmp

Filesize
1.0MB

Download
memory/2044-56-0x0000000000300000-0x0000000000318000-memory.dmp

Filesize
96KB

Download
memory/2044-57-0x00000000002E0000-0x00000000002EC000-memory.dmp

Filesize
48KB

Download
memory/2044-63-0x0000000004CD0000-0x0000000004D1E000-memory.dmp

Filesize
312KB

Download
memory/2044-55-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download

description	pid	process	target process
PID 2044 wrote to memory of 1540	2044	Remittance AdviceInvoice and parking List pdf.exe	powershell.exe
PID 2044 wrote to memory of 1540	2044	Remittance AdviceInvoice and parking List pdf.exe	powershell.exe
PID 2044 wrote to memory of 1540	2044	Remittance AdviceInvoice and parking List pdf.exe	powershell.exe
PID 2044 wrote to memory of 1540	2044	Remittance AdviceInvoice and parking List pdf.exe	powershell.exe
PID 2044 wrote to memory of 1392	2044	Remittance AdviceInvoice and parking List pdf.exe	schtasks.exe
PID 2044 wrote to memory of 1392	2044	Remittance AdviceInvoice and parking List pdf.exe	schtasks.exe
PID 2044 wrote to memory of 1392	2044	Remittance AdviceInvoice and parking List pdf.exe	schtasks.exe
PID 2044 wrote to memory of 1392	2044	Remittance AdviceInvoice and parking List pdf.exe	schtasks.exe
PID 2044 wrote to memory of 524	2044	Remittance AdviceInvoice and parking List pdf.exe	Remittance AdviceInvoice and parking List pdf.exe
PID 2044 wrote to memory of 524	2044	Remittance AdviceInvoice and parking List pdf.exe	Remittance AdviceInvoice and parking List pdf.exe
PID 2044 wrote to memory of 524	2044	Remittance AdviceInvoice and parking List pdf.exe	Remittance AdviceInvoice and parking List pdf.exe
PID 2044 wrote to memory of 524	2044	Remittance AdviceInvoice and parking List pdf.exe	Remittance AdviceInvoice and parking List pdf.exe
PID 2044 wrote to memory of 900	2044	Remittance AdviceInvoice and parking List pdf.exe	Remittance AdviceInvoice and parking List pdf.exe
PID 2044 wrote to memory of 900	2044	Remittance AdviceInvoice and parking List pdf.exe	Remittance AdviceInvoice and parking List pdf.exe
PID 2044 wrote to memory of 900	2044	Remittance AdviceInvoice and parking List pdf.exe	Remittance AdviceInvoice and parking List pdf.exe
PID 2044 wrote to memory of 900	2044	Remittance AdviceInvoice and parking List pdf.exe	Remittance AdviceInvoice and parking List pdf.exe
PID 2044 wrote to memory of 900	2044	Remittance AdviceInvoice and parking List pdf.exe	Remittance AdviceInvoice and parking List pdf.exe
PID 2044 wrote to memory of 900	2044	Remittance AdviceInvoice and parking List pdf.exe	Remittance AdviceInvoice and parking List pdf.exe
PID 2044 wrote to memory of 900	2044	Remittance AdviceInvoice and parking List pdf.exe	Remittance AdviceInvoice and parking List pdf.exe
PID 2044 wrote to memory of 900	2044	Remittance AdviceInvoice and parking List pdf.exe	Remittance AdviceInvoice and parking List pdf.exe
PID 2044 wrote to memory of 900	2044	Remittance AdviceInvoice and parking List pdf.exe	Remittance AdviceInvoice and parking List pdf.exe
PID 2044 wrote to memory of 900	2044	Remittance AdviceInvoice and parking List pdf.exe	Remittance AdviceInvoice and parking List pdf.exe
PID 2044 wrote to memory of 900	2044	Remittance AdviceInvoice and parking List pdf.exe	Remittance AdviceInvoice and parking List pdf.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads