netwire | 9852b6d615cc6d7e5e61044d3cb167bff5bcc528ba0dcb6de4e39de6105d5e42

General

Target

Product_Order_Quotation_X1208.exe
Size

322KB
MD5

709714b4261957287537f7f78e6dbdfb
SHA1

82f2efbbf0c86913932567caf70ae6f66665bec9
SHA256

72c3b0ef24972aa0269b5084d27257fa83229ddca82ae020de2194e9ed7cbb0f
SHA512

e969eba70b15e3b346931a5f812f38c20be028b30cc2512d1410d2cbdabd0664d3e9d3a56b6cd83f4e0b88ac66cb5326802d2c0a831deb138ee64b8586141601
SSDEEP

6144:my1lpFvAAkTIo9OVP8YW5hQ9wDdRrz7sn1q0eop5MvuMpGxByK/tdA8F8Tz:mAn2oZ8J5ySDdx+sySvfi0GTA8F8Tz

Score

10^/10

netwire botnet rat stealer upx

Malware Config

Extracted

Family

netwire

C2

franrnar.com.tw:1009

Attributes

activex_autorun
false
copy_executable
true
delete_original
true
host_id
HostId-%Rand%
install_path
%AppData%\Microsoft\windows\explorer.exe
keylogger_dir
%AppData%\Microsoft\windows\Logs\
lock_executable
true
mutex
LqICFQGC
offline_keylogger
true
password
GetTheFuckOFf
registry_autorun
true
startup_name
iexplorer
use_mutex
true

Signatures

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/896-66-0x0000000000400000-0x0000000000423000-memory.dmp	netwire
behavioral1/memory/896-70-0x0000000000400000-0x0000000000423000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

explorer.exe

pid process

1112 explorer.exe

pid	process
1112	explorer.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/896-57-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/896-59-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/896-60-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/896-65-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/896-66-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/896-70-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

Product_Order_Quotation_X1208.exe

pid process

896 Product_Order_Quotation_X1208.exe
896 Product_Order_Quotation_X1208.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Product_Order_Quotation_X1208.exe

description pid process target process

PID 1832 set thread context of 896 1832 Product_Order_Quotation_X1208.exe Product_Order_Quotation_X1208.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Product_Order_Quotation_X1208.exeexplorer.exe

pid process

1832 Product_Order_Quotation_X1208.exe
1832 Product_Order_Quotation_X1208.exe
1112 explorer.exe
1112 explorer.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Product_Order_Quotation_X1208.exeexplorer.exe

description pid process

Token: SeDebugPrivilege 1832 Product_Order_Quotation_X1208.exe
Token: SeDebugPrivilege 1112 explorer.exe

pid	process
896	Product_Order_Quotation_X1208.exe
896	Product_Order_Quotation_X1208.exe

description	pid	process	target process
PID 1832 set thread context of 896	1832	Product_Order_Quotation_X1208.exe	Product_Order_Quotation_X1208.exe

pid	process
1832	Product_Order_Quotation_X1208.exe
1832	Product_Order_Quotation_X1208.exe
1112	explorer.exe
1112	explorer.exe

description	pid	process
Token: SeDebugPrivilege	1832	Product_Order_Quotation_X1208.exe
Token: SeDebugPrivilege	1112	explorer.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Product_Order_Quotation_X1208.exeProduct_Order_Quotation_X1208.exe

description	pid	process	target process
PID 1832 wrote to memory of 896	1832	Product_Order_Quotation_X1208.exe	Product_Order_Quotation_X1208.exe
PID 1832 wrote to memory of 896	1832	Product_Order_Quotation_X1208.exe	Product_Order_Quotation_X1208.exe
PID 1832 wrote to memory of 896	1832	Product_Order_Quotation_X1208.exe	Product_Order_Quotation_X1208.exe
PID 1832 wrote to memory of 896	1832	Product_Order_Quotation_X1208.exe	Product_Order_Quotation_X1208.exe
PID 1832 wrote to memory of 896	1832	Product_Order_Quotation_X1208.exe	Product_Order_Quotation_X1208.exe
PID 1832 wrote to memory of 896	1832	Product_Order_Quotation_X1208.exe	Product_Order_Quotation_X1208.exe
PID 1832 wrote to memory of 896	1832	Product_Order_Quotation_X1208.exe	Product_Order_Quotation_X1208.exe
PID 1832 wrote to memory of 896	1832	Product_Order_Quotation_X1208.exe	Product_Order_Quotation_X1208.exe
PID 896 wrote to memory of 1112	896	Product_Order_Quotation_X1208.exe	explorer.exe
PID 896 wrote to memory of 1112	896	Product_Order_Quotation_X1208.exe	explorer.exe
PID 896 wrote to memory of 1112	896	Product_Order_Quotation_X1208.exe	explorer.exe
PID 896 wrote to memory of 1112	896	Product_Order_Quotation_X1208.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\Product_Order_Quotation_X1208.exe
"C:\Users\Admin\AppData\Local\Temp\Product_Order_Quotation_X1208.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832

C:\Users\Admin\AppData\Local\Temp\Product_Order_Quotation_X1208.exe
"C:\Users\Admin\AppData\Local\Temp\Product_Order_Quotation_X1208.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:896

C:\Users\Admin\AppData\Roaming\Microsoft\windows\explorer.exe
-m "C:\Users\Admin\AppData\Local\Temp\Product_Order_Quotation_X1208.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1112

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
Filesize
322KB

MD5
709714b4261957287537f7f78e6dbdfb

SHA1
82f2efbbf0c86913932567caf70ae6f66665bec9

SHA256
72c3b0ef24972aa0269b5084d27257fa83229ddca82ae020de2194e9ed7cbb0f

SHA512
e969eba70b15e3b346931a5f812f38c20be028b30cc2512d1410d2cbdabd0664d3e9d3a56b6cd83f4e0b88ac66cb5326802d2c0a831deb138ee64b8586141601

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\windows\explorer.exe
Filesize
322KB

MD5
709714b4261957287537f7f78e6dbdfb

SHA1
82f2efbbf0c86913932567caf70ae6f66665bec9

SHA256
72c3b0ef24972aa0269b5084d27257fa83229ddca82ae020de2194e9ed7cbb0f

SHA512
e969eba70b15e3b346931a5f812f38c20be028b30cc2512d1410d2cbdabd0664d3e9d3a56b6cd83f4e0b88ac66cb5326802d2c0a831deb138ee64b8586141601

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
Filesize
322KB

MD5
709714b4261957287537f7f78e6dbdfb

SHA1
82f2efbbf0c86913932567caf70ae6f66665bec9

SHA256
72c3b0ef24972aa0269b5084d27257fa83229ddca82ae020de2194e9ed7cbb0f

SHA512
e969eba70b15e3b346931a5f812f38c20be028b30cc2512d1410d2cbdabd0664d3e9d3a56b6cd83f4e0b88ac66cb5326802d2c0a831deb138ee64b8586141601

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
Filesize
322KB

MD5
709714b4261957287537f7f78e6dbdfb

SHA1
82f2efbbf0c86913932567caf70ae6f66665bec9

SHA256
72c3b0ef24972aa0269b5084d27257fa83229ddca82ae020de2194e9ed7cbb0f

SHA512
e969eba70b15e3b346931a5f812f38c20be028b30cc2512d1410d2cbdabd0664d3e9d3a56b6cd83f4e0b88ac66cb5326802d2c0a831deb138ee64b8586141601

Download Submit
memory/896-65-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/896-60-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/896-61-0x0000000000421700-mapping.dmp

Download
memory/896-66-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/896-59-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/896-70-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/896-57-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/896-56-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1112-69-0x0000000000000000-mapping.dmp

Download
memory/1112-74-0x0000000074E20000-0x00000000753CB000-memory.dmp

Filesize
5.7MB

Download
memory/1832-63-0x0000000074EA0000-0x000000007544B000-memory.dmp

Filesize
5.7MB

Download
memory/1832-54-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/1832-55-0x0000000074EA0000-0x000000007544B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads