netwire | be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d

General

Target

be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe
Size

143KB
MD5

7146fadada85da5c561b6a5db6593c50
SHA1

7ddb7a384785c1fc830d36df9b424c1b9172ae78
SHA256

be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d
SHA512

3db8eb689c9f95bb3ac705242d15188c73a2498a04f728eb73e16af00cc03b828afb8e0ac2630f9201bee57189f0c1c3bfef650871fb09e5929ec6b27dd83d04
SSDEEP

3072:HAsj8MBX8s0oXJn45tph2Zp6GyNuBvjelAqx7NNST1/0+O:HAsBZlan2ZIIhelAql21/0+O

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4868-138-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/4868-140-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/4868-141-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/4868-142-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Loads dropped DLL 3 IoCs

Processes:

be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe

pid	process
2768	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe
2768	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe
2768	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windowsdating = "C:\\Users\\Admin\\AppData\\Local\\Temp\\be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe"	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe

description	pid	process	target process
PID 2768 set thread context of 4868	2768	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe

description	pid	process	target process
PID 2768 wrote to memory of 4868	2768	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe
PID 2768 wrote to memory of 4868	2768	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe
PID 2768 wrote to memory of 4868	2768	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe
PID 2768 wrote to memory of 4868	2768	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe
PID 2768 wrote to memory of 4868	2768	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe
PID 2768 wrote to memory of 4868	2768	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe
PID 2768 wrote to memory of 4868	2768	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe
PID 2768 wrote to memory of 4868	2768	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe
PID 2768 wrote to memory of 4868	2768	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe	be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe

C:\Users\Admin\AppData\Local\Temp\be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe
"C:\Users\Admin\AppData\Local\Temp\be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2768

C:\Users\Admin\AppData\Local\Temp\be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe
"C:\Users\Admin\AppData\Local\Temp\be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe"
2⤵
- Adds Run key to start application
PID:4868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\catnips.dll

Filesize
64KB

MD5
d4c4fd18b18f198868635ed49d313429

SHA1
abc0edf259654aa4a5709a331091e5c351388966

SHA256
a5143753449c03d36308d9e9a799d6bd3e2bb02a601c90ff145acf3942b1e30b

SHA512
9b068ab27c3c1aad766eb56cc38b1abf1d995209455c396531e3d0dc62cb49e2df28f98b4249e8afeb6bdc9ae7c3207ad014c9267630c0d47df9ed6d9a265943

Download Submit
C:\Users\Admin\AppData\Local\Temp\catnips.dll

Filesize
64KB

MD5
d4c4fd18b18f198868635ed49d313429

SHA1
abc0edf259654aa4a5709a331091e5c351388966

SHA256
a5143753449c03d36308d9e9a799d6bd3e2bb02a601c90ff145acf3942b1e30b

SHA512
9b068ab27c3c1aad766eb56cc38b1abf1d995209455c396531e3d0dc62cb49e2df28f98b4249e8afeb6bdc9ae7c3207ad014c9267630c0d47df9ed6d9a265943

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk1FA0.tmp\System.dll

Filesize
11KB

MD5
883eff06ac96966270731e4e22817e11

SHA1
523c87c98236cbc04430e87ec19b977595092ac8

SHA256
44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

SHA512
60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

Download Submit
memory/2768-135-0x0000000003000000-0x0000000003011000-memory.dmp

Filesize
68KB

Download
memory/4868-137-0x0000000000000000-mapping.dmp

Download
memory/4868-138-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4868-140-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4868-141-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4868-142-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads