netwire | 955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9

General

Target

955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe
Size

176KB
MD5

9268508a09560d1b1a357ef733516b90
SHA1

9d0707e5d3a8c21b88eea5b1f931da6706560550
SHA256

955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9
SHA512

442c4c0b001cc1156294a5aad3346e084ed83e82fa08bff13e046f24c90e2ef0264cf73576399c16cff1e48f6ec6ca4a4a228e33d5539da51227fc08319b9833
SSDEEP

3072:s+Ny9+cjza5VAkkP/6ady9I7mcvho6UbquHBjH9zbd66:s+AUcPajFa6sy98vd6tO

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1608-58-0x0000000000402196-mapping.dmp	netwire
behavioral1/memory/1608-57-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1608-62-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1608-63-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{22JQ0674-2M0B-0140-00FP-GJ672RQ427P8}	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{22JQ0674-2M0B-0140-00FP-GJ672RQ427P8}\StubPath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe\""	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Local\\Temp\\955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe"	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe

description	pid	process	target process
PID 1480 set thread context of 1608	1480	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe

pid process

1480 955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe

pid	process
1480	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe

description	pid	process	target process
PID 1480 wrote to memory of 1608	1480	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe
PID 1480 wrote to memory of 1608	1480	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe
PID 1480 wrote to memory of 1608	1480	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe
PID 1480 wrote to memory of 1608	1480	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe
PID 1480 wrote to memory of 1608	1480	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe
PID 1480 wrote to memory of 1608	1480	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe
PID 1480 wrote to memory of 1608	1480	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe
PID 1480 wrote to memory of 1608	1480	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe
PID 1480 wrote to memory of 1608	1480	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe
PID 1480 wrote to memory of 1608	1480	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe
PID 1480 wrote to memory of 1608	1480	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe	955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe

C:\Users\Admin\AppData\Local\Temp\955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe
"C:\Users\Admin\AppData\Local\Temp\955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480

C:\Users\Admin\AppData\Local\Temp\955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe
"C:\Users\Admin\AppData\Local\Temp\955669cb66cbfba78d1291a18a8f7c077a7adcb13bf727f757a31b886385e6d9.exe"
2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:1608

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1480-56-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/1480-59-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/1608-58-0x0000000000402196-mapping.dmp

Download
memory/1608-57-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1608-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1608-63-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads