netwire | d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10

General

Target

d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe
Size

665KB
MD5

e604dde86770970ad78d95b1ade0c331
SHA1

6359fb645f225302af32574659df56638c9b281f
SHA256

d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10
SHA512

dec6dd01f853195f9262c8a9d6a86b7ded784f3e38f9a51338b93716d39f4f37d45ae6c056e0668a20b0254ed5bb7feb70a7cedf491de7f7aea8991f6de97eee
SSDEEP

12288:P/ctFu3XDG2bv6NpVzJtqM8rp5cKcPONzs13IdqNQhPUM4zG:P/cEG2zOpVNtqM8UKcWNz+Zz

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

212.193.30.230:3363

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Password@2
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1952-69-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1952-70-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1952-71-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1952-73-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1952-75-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1952-74-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1952-78-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1952-79-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

Processes:

d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe

description	pid	process	target process
PID 2020 set thread context of 1952	2020	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

908 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

960 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 960 powershell.exe

pid	process
908	schtasks.exe

pid	process
960	powershell.exe

description	pid	process
Token: SeDebugPrivilege	960	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe

C:\Users\Admin\AppData\Local\Temp\d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe
"C:\Users\Admin\AppData\Local\Temp\d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rqbpXAkwu.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:960

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rqbpXAkwu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp41E1.tmp"
2⤵
- Creates scheduled task(s)
PID:908

C:\Users\Admin\AppData\Local\Temp\d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe
"C:\Users\Admin\AppData\Local\Temp\d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe"
2⤵
PID:1952

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp41E1.tmp
Filesize
1KB

MD5
bcc03594061cc7ba109aec3ae4bf6440

SHA1
fb2e64168b4eeb63568bfd085bc86857d11ed30e

SHA256
a530859a6b398388f36ab64887019fdc687e61adb13f67d239d11cf51fab2101

SHA512
19ca77dae09f5eee14e20af44a886cf60611efcd940c50368f074d375a1c4d82c22b40cb50d9fb8dd01bb2888118273167fb2cf84b95b10ff93de1e45d177045

Download Submit
memory/908-60-0x0000000000000000-mapping.dmp

Download
memory/960-59-0x0000000000000000-mapping.dmp

Download
memory/960-81-0x000000006DE00000-0x000000006E3AB000-memory.dmp

Filesize
5.7MB

Download
memory/960-80-0x000000006DE00000-0x000000006E3AB000-memory.dmp

Filesize
5.7MB

Download
memory/1952-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1952-78-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1952-79-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1952-74-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1952-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1952-75-0x000000000040242D-mapping.dmp

Download
memory/1952-67-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1952-69-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1952-70-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1952-71-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1952-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2020-54-0x0000000001350000-0x00000000013FC000-memory.dmp

Filesize
688KB

Download
memory/2020-63-0x0000000000F80000-0x0000000000FAE000-memory.dmp

Filesize
184KB

Download
memory/2020-58-0x0000000005D50000-0x0000000005DCE000-memory.dmp

Filesize
504KB

Download
memory/2020-57-0x0000000000480000-0x000000000048C000-memory.dmp

Filesize
48KB

Download
memory/2020-56-0x0000000000420000-0x000000000043A000-memory.dmp

Filesize
104KB

Download
memory/2020-55-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download

description	pid	process	target process
PID 2020 wrote to memory of 960	2020	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe	powershell.exe
PID 2020 wrote to memory of 960	2020	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe	powershell.exe
PID 2020 wrote to memory of 960	2020	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe	powershell.exe
PID 2020 wrote to memory of 960	2020	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe	powershell.exe
PID 2020 wrote to memory of 908	2020	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe	schtasks.exe
PID 2020 wrote to memory of 908	2020	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe	schtasks.exe
PID 2020 wrote to memory of 908	2020	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe	schtasks.exe
PID 2020 wrote to memory of 908	2020	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe	schtasks.exe
PID 2020 wrote to memory of 1952	2020	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe
PID 2020 wrote to memory of 1952	2020	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe
PID 2020 wrote to memory of 1952	2020	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe
PID 2020 wrote to memory of 1952	2020	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe
PID 2020 wrote to memory of 1952	2020	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe
PID 2020 wrote to memory of 1952	2020	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe
PID 2020 wrote to memory of 1952	2020	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe
PID 2020 wrote to memory of 1952	2020	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe
PID 2020 wrote to memory of 1952	2020	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe
PID 2020 wrote to memory of 1952	2020	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe
PID 2020 wrote to memory of 1952	2020	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe
PID 2020 wrote to memory of 1952	2020	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe	d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads