netwire | 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f

General

Target

895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe
Size

138KB
MD5

77dfe5880ce35fe13c0f50a142ab8907
SHA1

e87635becb3234776d8e70e89cdd1669cae33e37
SHA256

895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f
SHA512

cd157579223e86a3c3d9e2ef88ab87f558801cd8cac947242338e09493826e7777465384f594471f44087422fcd3b3fcdf5ed0dc2df2b023e5fc815f000eb5d4
SSDEEP

3072:bAsj8MBX8s0oXJn45Hy381mrQ3cPSgWq1SLrsDBL5EGrDx4d4:bAsBZd8Y8gUAs+DBdY4

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1444-62-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1444-64-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1444-65-0x00000000004021DA-mapping.dmp	netwire
behavioral1/memory/1444-68-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1444-69-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Loads dropped DLL 2 IoCs

Processes:

895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe

pid	process
2020	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe
2020	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Local\\Temp\\895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe"	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe

description	pid	process	target process
PID 2020 set thread context of 1444	2020	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe

description	pid	process	target process
PID 2020 wrote to memory of 1444	2020	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe
PID 2020 wrote to memory of 1444	2020	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe
PID 2020 wrote to memory of 1444	2020	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe
PID 2020 wrote to memory of 1444	2020	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe
PID 2020 wrote to memory of 1444	2020	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe
PID 2020 wrote to memory of 1444	2020	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe
PID 2020 wrote to memory of 1444	2020	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe
PID 2020 wrote to memory of 1444	2020	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe
PID 2020 wrote to memory of 1444	2020	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe	895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe

C:\Users\Admin\AppData\Local\Temp\895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe
"C:\Users\Admin\AppData\Local\Temp\895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Local\Temp\895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe
"C:\Users\Admin\AppData\Local\Temp\895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe"
2⤵
- Adds Run key to start application
PID:1444

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\farness.dll
Filesize
70KB

MD5
5ae14056745d7c103b412645fb8e71cf

SHA1
8be10a68e7e0fb98c247b3655afedafcbb6a52a7

SHA256
55d0cb156c35836a52d6276021f4fedb8022240c4903fdd4a3e444c06ab5ec1a

SHA512
87a334a09a38de95ca532ef9bda40836a29eeb81267bd9b906e9ad8d3f85f779e3e87d5e136e841b160d6ac5da63502d80a016d3451ba3f0640d431de47e2ff8

Download Submit
\Users\Admin\AppData\Local\Temp\nsyA42E.tmp\System.dll
Filesize
11KB

MD5
883eff06ac96966270731e4e22817e11

SHA1
523c87c98236cbc04430e87ec19b977595092ac8

SHA256
44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

SHA512
60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

Download Submit
memory/1444-57-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1444-58-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1444-60-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1444-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1444-64-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1444-65-0x00000000004021DA-mapping.dmp

Download
memory/1444-68-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1444-69-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2020-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads