netwire | dafb646a7948bda63b6e179079b61be12ba850a671d6599f4ddc0a3d9856f38a

General

Target

dafb646a7948bda63b6e179079b61be12ba850a671d6599f4ddc0a3d9856f38a.exe
Size

634KB
MD5

2bdcb5958fee4871f0b780fadc34e0a8
SHA1

8d2071387c8de8081479153b331c5d34d6cf6d0d
SHA256

dafb646a7948bda63b6e179079b61be12ba850a671d6599f4ddc0a3d9856f38a
SHA512

cf75975843837fbe961b4485d9c5efb45d7a71a3d1e2980c1975782e6aad7bf10ff0db7cf637e443d19f585906ff6062955ff6ba38ddbec0de178dd4d0a63436
SSDEEP

6144:ecCmiQfipBKWzkeHrb08rTj6aBpSYdS1wjzcoeqqD97mmAxCofOTyAHoDK3E/WIx:ecXiQfipPrb08rTj6+pGWqAxwDqx

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

sex.gravitynet.lol:69

imgay.komarupics.cam:696

Attributes

activex_autorun
false
activex_key
{3L23H1WC-44VT-8C27-UFKB-4BWL52C45O6Y}
copy_executable
false
delete_original
false
host_id
RaptureV2
install_path
%AppData%\Chromium\mng.exe
keylogger_dir
JSCMNG.lnk
lock_executable
false
mutex
Revolt
offline_keylogger
false
password
IzumiTop
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Chromium\mng.exe	netwire
C:\Users\Admin\AppData\Roaming\Chromium\mng.exe	netwire
C:\Users\Admin\AppData\Roaming\Chromium\mng.exe	netwire
\Users\Admin\AppData\Roaming\Chromium\mng.exe	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

mng.exe

pid process

1188 mng.exe

pid	process
1188	mng.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

mng.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3L23H1WC-44VT-8C27-UFKB-4BWL52C45O6Y}	mng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3L23H1WC-44VT-8C27-UFKB-4BWL52C45O6Y}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Chromium\\mng.exe\""	mng.exe

Deletes itself 1 IoCs

Processes:

mng.exe

pid process

1188 mng.exe
Drops startup file 1 IoCs

Processes:

mng.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JSCMNG.lnk mng.exe
Loads dropped DLL 2 IoCs

Processes:

dafb646a7948bda63b6e179079b61be12ba850a671d6599f4ddc0a3d9856f38a.exemng.exe

pid process

1380 dafb646a7948bda63b6e179079b61be12ba850a671d6599f4ddc0a3d9856f38a.exe
1188 mng.exe

pid	process
1188	mng.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JSCMNG.lnk	mng.exe

pid	process
1380	dafb646a7948bda63b6e179079b61be12ba850a671d6599f4ddc0a3d9856f38a.exe
1188	mng.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

mng.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	mng.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ÙFc½[g¨-–úÕ0M]Ðì = "C:\\Users\\Admin\\AppData\\Roaming\\Chromium\\mng.exe"	mng.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

dafb646a7948bda63b6e179079b61be12ba850a671d6599f4ddc0a3d9856f38a.exe

description	pid	process	target process
PID 1380 wrote to memory of 1188	1380	dafb646a7948bda63b6e179079b61be12ba850a671d6599f4ddc0a3d9856f38a.exe	mng.exe
PID 1380 wrote to memory of 1188	1380	dafb646a7948bda63b6e179079b61be12ba850a671d6599f4ddc0a3d9856f38a.exe	mng.exe
PID 1380 wrote to memory of 1188	1380	dafb646a7948bda63b6e179079b61be12ba850a671d6599f4ddc0a3d9856f38a.exe	mng.exe
PID 1380 wrote to memory of 1188	1380	dafb646a7948bda63b6e179079b61be12ba850a671d6599f4ddc0a3d9856f38a.exe	mng.exe

C:\Users\Admin\AppData\Local\Temp\dafb646a7948bda63b6e179079b61be12ba850a671d6599f4ddc0a3d9856f38a.exe
"C:\Users\Admin\AppData\Local\Temp\dafb646a7948bda63b6e179079b61be12ba850a671d6599f4ddc0a3d9856f38a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1380

C:\Users\Admin\AppData\Roaming\Chromium\mng.exe
"C:\Users\Admin\AppData\Roaming\Chromium\mng.exe" -m "C:\Users\Admin\AppData\Local\Temp\dafb646a7948bda63b6e179079b61be12ba850a671d6599f4ddc0a3d9856f38a.exe"
2⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Deletes itself
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
PID:1188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Chromium\mng.exe

Filesize
634KB

MD5
2bdcb5958fee4871f0b780fadc34e0a8

SHA1
8d2071387c8de8081479153b331c5d34d6cf6d0d

SHA256
dafb646a7948bda63b6e179079b61be12ba850a671d6599f4ddc0a3d9856f38a

SHA512
cf75975843837fbe961b4485d9c5efb45d7a71a3d1e2980c1975782e6aad7bf10ff0db7cf637e443d19f585906ff6062955ff6ba38ddbec0de178dd4d0a63436

Download Submit
C:\Users\Admin\AppData\Roaming\Chromium\mng.exe

Filesize
634KB

MD5
2bdcb5958fee4871f0b780fadc34e0a8

SHA1
8d2071387c8de8081479153b331c5d34d6cf6d0d

SHA256
dafb646a7948bda63b6e179079b61be12ba850a671d6599f4ddc0a3d9856f38a

SHA512
cf75975843837fbe961b4485d9c5efb45d7a71a3d1e2980c1975782e6aad7bf10ff0db7cf637e443d19f585906ff6062955ff6ba38ddbec0de178dd4d0a63436

Download Submit
\Users\Admin\AppData\Roaming\Chromium\mng.exe

Filesize
634KB

MD5
2bdcb5958fee4871f0b780fadc34e0a8

SHA1
8d2071387c8de8081479153b331c5d34d6cf6d0d

SHA256
dafb646a7948bda63b6e179079b61be12ba850a671d6599f4ddc0a3d9856f38a

SHA512
cf75975843837fbe961b4485d9c5efb45d7a71a3d1e2980c1975782e6aad7bf10ff0db7cf637e443d19f585906ff6062955ff6ba38ddbec0de178dd4d0a63436

Download Submit
\Users\Admin\AppData\Roaming\Chromium\mng.exe

Filesize
634KB

MD5
2bdcb5958fee4871f0b780fadc34e0a8

SHA1
8d2071387c8de8081479153b331c5d34d6cf6d0d

SHA256
dafb646a7948bda63b6e179079b61be12ba850a671d6599f4ddc0a3d9856f38a

SHA512
cf75975843837fbe961b4485d9c5efb45d7a71a3d1e2980c1975782e6aad7bf10ff0db7cf637e443d19f585906ff6062955ff6ba38ddbec0de178dd4d0a63436

Download Submit
memory/1188-56-0x0000000000000000-mapping.dmp

Download
memory/1380-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads