netwire | 9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e

General

Target

9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe
Size

807KB
MD5

e98ad81cc146f795a90c08fb481514fb
SHA1

3f0074cf8ded5ef492007b3381ae9c0ef42eb7be
SHA256

9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e
SHA512

455722030d9e08825c9d2b5a95514ad6fb177f46717bf0044d27abbcc4c7597166ce2d758903138e9925e9725fc9a1b716a1fc0d6b7515f24447047a16bb7b9b
SSDEEP

12288:+xEdknAFT9qyhDLtLd/o4SzBmAYMueHxADqjJ5n:/DhDJLO4SzBmAYMFjr

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

37.0.14.206:3384

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
true
offline_keylogger
true
password
Password234
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1928-140-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/1928-142-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/1928-143-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/3092-153-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/3092-154-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

Host.exeHost.exe

pid process

1864 Host.exe
3092 Host.exe

pid	process
1864	Host.exe
3092	Host.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exeHost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	Host.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exeHost.exe

description	pid	process	target process
PID 2468 set thread context of 1928	2468	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe
PID 1864 set thread context of 3092	1864	Host.exe	Host.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4304 schtasks.exe
1232 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exeHost.exe

pid process

2468 9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe
1864 Host.exe

pid	process
4304	schtasks.exe
1232	schtasks.exe

pid	process
2468	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe
1864	Host.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exeHost.exe

description	pid	process
Token: SeDebugPrivilege	2468	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe
Token: SeDebugPrivilege	1864	Host.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exeHost.exe

description	pid	process	target process
PID 2468 wrote to memory of 4304	2468	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe	schtasks.exe
PID 2468 wrote to memory of 4304	2468	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe	schtasks.exe
PID 2468 wrote to memory of 4304	2468	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe	schtasks.exe
PID 2468 wrote to memory of 1928	2468	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe
PID 2468 wrote to memory of 1928	2468	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe
PID 2468 wrote to memory of 1928	2468	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe
PID 2468 wrote to memory of 1928	2468	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe
PID 2468 wrote to memory of 1928	2468	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe
PID 2468 wrote to memory of 1928	2468	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe
PID 2468 wrote to memory of 1928	2468	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe
PID 2468 wrote to memory of 1928	2468	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe
PID 2468 wrote to memory of 1928	2468	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe
PID 2468 wrote to memory of 1928	2468	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe
PID 2468 wrote to memory of 1928	2468	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe
PID 1928 wrote to memory of 1864	1928	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe	Host.exe
PID 1928 wrote to memory of 1864	1928	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe	Host.exe
PID 1928 wrote to memory of 1864	1928	9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe	Host.exe
PID 1864 wrote to memory of 1232	1864	Host.exe	schtasks.exe
PID 1864 wrote to memory of 1232	1864	Host.exe	schtasks.exe
PID 1864 wrote to memory of 1232	1864	Host.exe	schtasks.exe
PID 1864 wrote to memory of 3092	1864	Host.exe	Host.exe
PID 1864 wrote to memory of 3092	1864	Host.exe	Host.exe
PID 1864 wrote to memory of 3092	1864	Host.exe	Host.exe
PID 1864 wrote to memory of 3092	1864	Host.exe	Host.exe
PID 1864 wrote to memory of 3092	1864	Host.exe	Host.exe
PID 1864 wrote to memory of 3092	1864	Host.exe	Host.exe
PID 1864 wrote to memory of 3092	1864	Host.exe	Host.exe
PID 1864 wrote to memory of 3092	1864	Host.exe	Host.exe
PID 1864 wrote to memory of 3092	1864	Host.exe	Host.exe
PID 1864 wrote to memory of 3092	1864	Host.exe	Host.exe
PID 1864 wrote to memory of 3092	1864	Host.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe
"C:\Users\Admin\AppData\Local\Temp\9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PbPgJXRhYzvGb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF7E3.tmp"
2⤵
- Creates scheduled task(s)
PID:4304

C:\Users\Admin\AppData\Local\Temp\9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e.exe
"{path}"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1928

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PbPgJXRhYzvGb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6264.tmp"
4⤵
- Creates scheduled task(s)
PID:1232

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"{path}"
4⤵
- Executes dropped EXE
PID:3092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6264.tmp

Filesize
1KB

MD5
b4fa2be1e325c9543b723858cdd2bb55

SHA1
12010d537ba2eefba4b3774b6911b86c5b30dc58

SHA256
116c2d7c96ad093657eb204cf45e31fc084c034e98aa2042afc152e2d9edf965

SHA512
762fdc1549b7bab4254a7eb62cb53b672f477c2af96f1c83bc4c67b6a12e29f16e5603271f63d22aa84c677f522ff82b529c9c7799dd1d8bf5bd79f8b15e4481

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF7E3.tmp

Filesize
1KB

MD5
b4fa2be1e325c9543b723858cdd2bb55

SHA1
12010d537ba2eefba4b3774b6911b86c5b30dc58

SHA256
116c2d7c96ad093657eb204cf45e31fc084c034e98aa2042afc152e2d9edf965

SHA512
762fdc1549b7bab4254a7eb62cb53b672f477c2af96f1c83bc4c67b6a12e29f16e5603271f63d22aa84c677f522ff82b529c9c7799dd1d8bf5bd79f8b15e4481

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
807KB

MD5
e98ad81cc146f795a90c08fb481514fb

SHA1
3f0074cf8ded5ef492007b3381ae9c0ef42eb7be

SHA256
9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e

SHA512
455722030d9e08825c9d2b5a95514ad6fb177f46717bf0044d27abbcc4c7597166ce2d758903138e9925e9725fc9a1b716a1fc0d6b7515f24447047a16bb7b9b

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
807KB

MD5
e98ad81cc146f795a90c08fb481514fb

SHA1
3f0074cf8ded5ef492007b3381ae9c0ef42eb7be

SHA256
9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e

SHA512
455722030d9e08825c9d2b5a95514ad6fb177f46717bf0044d27abbcc4c7597166ce2d758903138e9925e9725fc9a1b716a1fc0d6b7515f24447047a16bb7b9b

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
807KB

MD5
e98ad81cc146f795a90c08fb481514fb

SHA1
3f0074cf8ded5ef492007b3381ae9c0ef42eb7be

SHA256
9425ac2ec74d9ac879b675ada25ffd49b4d5b72804eacea57ab31669719f7b1e

SHA512
455722030d9e08825c9d2b5a95514ad6fb177f46717bf0044d27abbcc4c7597166ce2d758903138e9925e9725fc9a1b716a1fc0d6b7515f24447047a16bb7b9b

Download Submit
memory/1232-147-0x0000000000000000-mapping.dmp

Download
memory/1864-144-0x0000000000000000-mapping.dmp

Download
memory/1928-143-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1928-140-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1928-142-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1928-139-0x0000000000000000-mapping.dmp

Download
memory/2468-132-0x0000000000430000-0x0000000000500000-memory.dmp

Filesize
832KB

Download
memory/2468-136-0x0000000004F50000-0x0000000004F5A000-memory.dmp

Filesize
40KB

Download
memory/2468-135-0x0000000004FD0000-0x000000000506C000-memory.dmp

Filesize
624KB

Download
memory/2468-134-0x0000000004E90000-0x0000000004F22000-memory.dmp

Filesize
584KB

Download
memory/2468-133-0x0000000005350000-0x00000000058F4000-memory.dmp

Filesize
5.6MB

Download
memory/3092-149-0x0000000000000000-mapping.dmp

Download
memory/3092-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3092-154-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4304-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads