netwire | 2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45

General

Target

2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe
Size

136KB
MD5

79ab9456804604d09f61971be7bca6e0
SHA1

a248e55f44535af03155d39a3a4238b01f8c547f
SHA256

2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45
SHA512

0e3eb6a9f5c4029e9969f4b5533159893b5d23456f4c921ec62950ba5a6eb99379714819b18dc5a36851bd744eda1fdd56f749e27b838bf7eac67479c237866a
SSDEEP

3072:fDYGrNMoDe7BQA0bLVZ9xthsDgichP9eATG1pnrH:7YgFYBQNLVnxgDRcWA

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1356-57-0x0000000000000000-mapping.dmp	netwire
behavioral1/memory/1356-59-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1356-61-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1356-62-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{63CQFD68-O63X-K1HU-4N82-K20A56DD54A8}	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{63CQFD68-O63X-K1HU-4N82-K20A56DD54A8}\StubPath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe\""	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\startup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe"	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe

pid process

1716 2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe

pid	process
1716	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe

C:\Users\Admin\AppData\Local\Temp\2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe
"C:\Users\Admin\AppData\Local\Temp\2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716

C:\Users\Admin\AppData\Local\Temp\2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe
"C:\Users\Admin\AppData\Local\Temp\2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe"
2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:1356

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1356-57-0x0000000000000000-mapping.dmp

Download
memory/1356-59-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1356-61-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1356-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1716-56-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download
memory/1716-58-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download

description	pid	process	target process
PID 1716 wrote to memory of 1356	1716	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe
PID 1716 wrote to memory of 1356	1716	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe
PID 1716 wrote to memory of 1356	1716	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe
PID 1716 wrote to memory of 1356	1716	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe
PID 1716 wrote to memory of 1356	1716	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe
PID 1716 wrote to memory of 1356	1716	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe
PID 1716 wrote to memory of 1356	1716	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe
PID 1716 wrote to memory of 1356	1716	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe
PID 1716 wrote to memory of 1356	1716	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe
PID 1716 wrote to memory of 1356	1716	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe
PID 1716 wrote to memory of 1356	1716	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe
PID 1716 wrote to memory of 1356	1716	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe
PID 1716 wrote to memory of 1356	1716	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe
PID 1716 wrote to memory of 1356	1716	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe
PID 1716 wrote to memory of 1356	1716	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe
PID 1716 wrote to memory of 1356	1716	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe	2269bc1d06260a0eabaf8927b13c2f2af46ddaeff896eb8e1d5d55c549ee2f45.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads