netwire | 4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5

General

Target

4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe
Size

1.2MB
MD5

29b108e40acb05c3c9c2fa8c19b166e3
SHA1

892c676275a723822d2d47dc1a48defec8bde643
SHA256

4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5
SHA512

9cee10259615c90ea51710fd119dc9c8899b8bf4363513ecbc79aa3a69351c68625f5ca5e7c521d2346a54640358eb2deba0fd6db08a7ade5d2970304ad5beb2
SSDEEP

24576:peW/uHyRLqHJ/wAmDZtRauPvqz6WQ5YQ9kXRGjr:peW/uSRLeJ4AmDZtPPvqzs5Y+kXRG

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

37.0.14.206:3384

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
lock_executable
false
offline_keylogger
false
password
Password234
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/112-66-0x0000000000400000-0x000000000044F000-memory.dmp	netwire
behavioral1/memory/112-68-0x0000000000400000-0x000000000044F000-memory.dmp	netwire
behavioral1/memory/112-69-0x0000000000400000-0x000000000044F000-memory.dmp	netwire
behavioral1/memory/112-71-0x0000000000400000-0x000000000044F000-memory.dmp	netwire
behavioral1/memory/112-72-0x000000000041AD7B-mapping.dmp	netwire
behavioral1/memory/112-75-0x0000000000400000-0x000000000044F000-memory.dmp	netwire
behavioral1/memory/112-78-0x0000000000400000-0x000000000044F000-memory.dmp	netwire
behavioral1/memory/112-80-0x0000000000400000-0x000000000044F000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

Host.exe

pid process

1144 Host.exe
Loads dropped DLL 1 IoCs

Processes:

4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe

pid process

112 4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe

pid	process
1144	Host.exe

pid	process
112	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe

description	pid	process	target process
PID 2032 set thread context of 112	2032	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1292 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe

pid process

2032 4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe

description pid process

Token: SeDebugPrivilege 2032 4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe

pid	process
1292	schtasks.exe

pid	process
2032	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe

description	pid	process
Token: SeDebugPrivilege	2032	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe

description	pid	process	target process
PID 2032 wrote to memory of 1292	2032	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe	schtasks.exe
PID 2032 wrote to memory of 1292	2032	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe	schtasks.exe
PID 2032 wrote to memory of 1292	2032	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe	schtasks.exe
PID 2032 wrote to memory of 1292	2032	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe	schtasks.exe
PID 2032 wrote to memory of 112	2032	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe
PID 2032 wrote to memory of 112	2032	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe
PID 2032 wrote to memory of 112	2032	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe
PID 2032 wrote to memory of 112	2032	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe
PID 2032 wrote to memory of 112	2032	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe
PID 2032 wrote to memory of 112	2032	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe
PID 2032 wrote to memory of 112	2032	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe
PID 2032 wrote to memory of 112	2032	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe
PID 2032 wrote to memory of 112	2032	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe
PID 2032 wrote to memory of 112	2032	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe
PID 2032 wrote to memory of 112	2032	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe
PID 112 wrote to memory of 1144	112	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe	Host.exe
PID 112 wrote to memory of 1144	112	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe	Host.exe
PID 112 wrote to memory of 1144	112	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe	Host.exe
PID 112 wrote to memory of 1144	112	4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe
"C:\Users\Admin\AppData\Local\Temp\4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NSopOOoiUVq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5B6A.tmp"
2⤵
- Creates scheduled task(s)
PID:1292

C:\Users\Admin\AppData\Local\Temp\4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5.exe
"{path}"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:112

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
3⤵
- Executes dropped EXE
PID:1144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5B6A.tmp

Filesize
1KB

MD5
5c5b74d74a6e9c93533cb58eb2715523

SHA1
958eede42a47a7e60492ad5f9480db31bfacec68

SHA256
81f21d92125919b1b17aebd3ceb8980a08b168e0a0678c4832f830884ed64ceb

SHA512
3480d47ef9b3ae46edd18b83944eeb14c8dbaca47583962f7dd8226e41f95cae80d85db6ea36180fc3f59dca63a360ebedfa5ac9aa9befe6ad5e8d83af2fd301

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
1.2MB

MD5
29b108e40acb05c3c9c2fa8c19b166e3

SHA1
892c676275a723822d2d47dc1a48defec8bde643

SHA256
4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5

SHA512
9cee10259615c90ea51710fd119dc9c8899b8bf4363513ecbc79aa3a69351c68625f5ca5e7c521d2346a54640358eb2deba0fd6db08a7ade5d2970304ad5beb2

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
1.2MB

MD5
29b108e40acb05c3c9c2fa8c19b166e3

SHA1
892c676275a723822d2d47dc1a48defec8bde643

SHA256
4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5

SHA512
9cee10259615c90ea51710fd119dc9c8899b8bf4363513ecbc79aa3a69351c68625f5ca5e7c521d2346a54640358eb2deba0fd6db08a7ade5d2970304ad5beb2

Download Submit
\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
1.2MB

MD5
29b108e40acb05c3c9c2fa8c19b166e3

SHA1
892c676275a723822d2d47dc1a48defec8bde643

SHA256
4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5

SHA512
9cee10259615c90ea51710fd119dc9c8899b8bf4363513ecbc79aa3a69351c68625f5ca5e7c521d2346a54640358eb2deba0fd6db08a7ade5d2970304ad5beb2

Download Submit
memory/112-75-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/112-71-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/112-80-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/112-61-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/112-62-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/112-64-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/112-66-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/112-68-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/112-69-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/112-78-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/112-72-0x000000000041AD7B-mapping.dmp

Download
memory/1144-77-0x0000000000000000-mapping.dmp

Download
memory/1144-82-0x0000000000020000-0x000000000014E000-memory.dmp

Filesize
1.2MB

Download
memory/1292-59-0x0000000000000000-mapping.dmp

Download
memory/2032-54-0x0000000000FF0000-0x000000000111E000-memory.dmp

Filesize
1.2MB

Download
memory/2032-57-0x0000000007F80000-0x0000000008056000-memory.dmp

Filesize
856KB

Download
memory/2032-56-0x00000000007C0000-0x00000000007E0000-memory.dmp

Filesize
128KB

Download
memory/2032-58-0x0000000004D70000-0x0000000004DFC000-memory.dmp

Filesize
560KB

Download
memory/2032-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads