netwire | bbb8f32686aeef229eb473b37891091b254eecae3eaff2b12624121f29e5332f

General

Target

bbb8f32686aeef229eb473b37891091b254eecae3eaff2b12624121f29e5332f.exe
Size

1009KB
MD5

e0cb5d5d7185aedd6296cf6e9b24bb29
SHA1

07c6d5f0719382324c7f8eaa0b85ac41b6c7bbb8
SHA256

bbb8f32686aeef229eb473b37891091b254eecae3eaff2b12624121f29e5332f
SHA512

0d26d66c1d62a3d8049c0fe89ba0e81bae40bf36f44515e0ffe166452b117ad4cbe1c1f3827eb6b87e00ed0165f11e1f472034a8ae0e092ddb7f382f61a153ca
SSDEEP

24576:48GzoEgINYDQ1ne69fgPR5wq8YDw9sr8E9lcqWUIHn4QdEtJYv2T8aHEzcBU0kmM:SwQJfURqq8YDw9sr8E9lcqWUIHn4QdEG

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1816-56-0x0000000000190000-0x00000000001A6000-memory.dmp	netwire
behavioral1/memory/1816-61-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/2008-63-0x0000000000400000-0x0000000000506000-memory.dmp	netwire
behavioral1/memory/2008-64-0x0000000000400000-0x0000000000506000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

Host.exe

pid process

2008 Host.exe

pid	process
2008	Host.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{48FBHSL5-6S3A-14Q2-75B7-QMJN524PIHP1}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\""	Host.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{48FBHSL5-6S3A-14Q2-75B7-QMJN524PIHP1}	Host.exe

Loads dropped DLL 1 IoCs

Processes:

bbb8f32686aeef229eb473b37891091b254eecae3eaff2b12624121f29e5332f.exe

pid process

1816 bbb8f32686aeef229eb473b37891091b254eecae3eaff2b12624121f29e5332f.exe

pid	process
1816	bbb8f32686aeef229eb473b37891091b254eecae3eaff2b12624121f29e5332f.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Net = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe"	Host.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Host.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

bbb8f32686aeef229eb473b37891091b254eecae3eaff2b12624121f29e5332f.exeHost.exe

pid process

1816 bbb8f32686aeef229eb473b37891091b254eecae3eaff2b12624121f29e5332f.exe
2008 Host.exe

pid	process
1816	bbb8f32686aeef229eb473b37891091b254eecae3eaff2b12624121f29e5332f.exe
2008	Host.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bbb8f32686aeef229eb473b37891091b254eecae3eaff2b12624121f29e5332f.exe

description	pid	process	target process
PID 1816 wrote to memory of 2008	1816	bbb8f32686aeef229eb473b37891091b254eecae3eaff2b12624121f29e5332f.exe	Host.exe
PID 1816 wrote to memory of 2008	1816	bbb8f32686aeef229eb473b37891091b254eecae3eaff2b12624121f29e5332f.exe	Host.exe
PID 1816 wrote to memory of 2008	1816	bbb8f32686aeef229eb473b37891091b254eecae3eaff2b12624121f29e5332f.exe	Host.exe
PID 1816 wrote to memory of 2008	1816	bbb8f32686aeef229eb473b37891091b254eecae3eaff2b12624121f29e5332f.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\bbb8f32686aeef229eb473b37891091b254eecae3eaff2b12624121f29e5332f.exe
"C:\Users\Admin\AppData\Local\Temp\bbb8f32686aeef229eb473b37891091b254eecae3eaff2b12624121f29e5332f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1816

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
2⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of UnmapMainImage
PID:2008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
1009KB

MD5
e0cb5d5d7185aedd6296cf6e9b24bb29

SHA1
07c6d5f0719382324c7f8eaa0b85ac41b6c7bbb8

SHA256
bbb8f32686aeef229eb473b37891091b254eecae3eaff2b12624121f29e5332f

SHA512
0d26d66c1d62a3d8049c0fe89ba0e81bae40bf36f44515e0ffe166452b117ad4cbe1c1f3827eb6b87e00ed0165f11e1f472034a8ae0e092ddb7f382f61a153ca

Download Submit
\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
1009KB

MD5
e0cb5d5d7185aedd6296cf6e9b24bb29

SHA1
07c6d5f0719382324c7f8eaa0b85ac41b6c7bbb8

SHA256
bbb8f32686aeef229eb473b37891091b254eecae3eaff2b12624121f29e5332f

SHA512
0d26d66c1d62a3d8049c0fe89ba0e81bae40bf36f44515e0ffe166452b117ad4cbe1c1f3827eb6b87e00ed0165f11e1f472034a8ae0e092ddb7f382f61a153ca

Download Submit
memory/1816-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1816-55-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/1816-56-0x0000000000190000-0x00000000001A6000-memory.dmp

Filesize
88KB

Download
memory/1816-61-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2008-58-0x0000000000000000-mapping.dmp

Download
memory/2008-62-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/2008-63-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/2008-64-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads