netwire | 8f24221caef706d4502572968c0cf1317e632ebcb64157a5a1dafbdde7fc642c

General

Target

Payment Slip.exe
Size

665KB
MD5

34dd3c65abeca163b3347a7623d5dfa9
SHA1

439b3d605cdbfbd34d9d9f66c9c4851dfd41fc25
SHA256

8f24221caef706d4502572968c0cf1317e632ebcb64157a5a1dafbdde7fc642c
SHA512

769e85ac91e207fdb5118b8da6b4d62152e3f18b59dbb3d8136f44bfe38200f4dea27d0c44183b2583cfdf22622cca81831fd201ec2cc200881fc0cc17179d47
SSDEEP

12288:1T6whuJ/Qvhzps7225LN2/4c2J8skPiTMLEF00WlCJm19H2n7T9jFPuUTi8DPN/P:nuJIs7229N2/O8sMBwF00WlC09H0T9jd

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

zonedx.ddns.net:3360

85.209.134.105:3360

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
true
offline_keylogger
true
password
Password9090
registry_autorun
true
startup_name
NetWire
use_mutex
false

Signatures

NetWire RAT payload 9 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1732-69-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1732-71-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1732-70-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1732-73-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1732-74-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1732-75-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1732-78-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1732-79-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1732-82-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Payment Slip.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Payment Slip.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Payment Slip.exe"	Payment Slip.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Payment Slip.exe

description pid process target process

PID 544 set thread context of 1732 544 Payment Slip.exe Payment Slip.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1308 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

976 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 976 powershell.exe

description	pid	process	target process
PID 544 set thread context of 1732	544	Payment Slip.exe	Payment Slip.exe

pid	process
1308	schtasks.exe

pid	process
976	powershell.exe

description	pid	process
Token: SeDebugPrivilege	976	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

Payment Slip.exe

description	pid	process	target process
PID 544 wrote to memory of 976	544	Payment Slip.exe	powershell.exe
PID 544 wrote to memory of 976	544	Payment Slip.exe	powershell.exe
PID 544 wrote to memory of 976	544	Payment Slip.exe	powershell.exe
PID 544 wrote to memory of 976	544	Payment Slip.exe	powershell.exe
PID 544 wrote to memory of 1308	544	Payment Slip.exe	schtasks.exe
PID 544 wrote to memory of 1308	544	Payment Slip.exe	schtasks.exe
PID 544 wrote to memory of 1308	544	Payment Slip.exe	schtasks.exe
PID 544 wrote to memory of 1308	544	Payment Slip.exe	schtasks.exe
PID 544 wrote to memory of 1732	544	Payment Slip.exe	Payment Slip.exe
PID 544 wrote to memory of 1732	544	Payment Slip.exe	Payment Slip.exe
PID 544 wrote to memory of 1732	544	Payment Slip.exe	Payment Slip.exe
PID 544 wrote to memory of 1732	544	Payment Slip.exe	Payment Slip.exe
PID 544 wrote to memory of 1732	544	Payment Slip.exe	Payment Slip.exe
PID 544 wrote to memory of 1732	544	Payment Slip.exe	Payment Slip.exe
PID 544 wrote to memory of 1732	544	Payment Slip.exe	Payment Slip.exe
PID 544 wrote to memory of 1732	544	Payment Slip.exe	Payment Slip.exe
PID 544 wrote to memory of 1732	544	Payment Slip.exe	Payment Slip.exe
PID 544 wrote to memory of 1732	544	Payment Slip.exe	Payment Slip.exe
PID 544 wrote to memory of 1732	544	Payment Slip.exe	Payment Slip.exe
PID 544 wrote to memory of 1732	544	Payment Slip.exe	Payment Slip.exe

C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:544

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hLjugFXbb.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:976

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hLjugFXbb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp59E4.tmp"
2⤵
- Creates scheduled task(s)
PID:1308

C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"
2⤵
- Adds Run key to start application
PID:1732

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp59E4.tmp
Filesize
1KB

MD5
f77dd3dab7c16a35044381fc378b8808

SHA1
b3ea40d72c7fffb64db8caac2d8c6da0b10c2552

SHA256
3c06523e88447566f4506a81384ea8f664e3987c3aaf3dbb51f26d5b049d7192

SHA512
b820d7137b3e6716b18e3967db7c76df87b40b9e9e2e901ccde5826310563bf4cd47d0d062d7b94ca4423b8bded3b260164ee3d21c69062e626c7229e696c163

Download Submit
memory/544-55-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/544-56-0x0000000000C10000-0x0000000000C2A000-memory.dmp

Filesize
104KB

Download
memory/544-57-0x0000000000320000-0x000000000032C000-memory.dmp

Filesize
48KB

Download
memory/544-58-0x0000000007600000-0x0000000007668000-memory.dmp

Filesize
416KB

Download
memory/544-63-0x0000000007270000-0x000000000729E000-memory.dmp

Filesize
184KB

Download
memory/544-54-0x0000000000E30000-0x0000000000EDC000-memory.dmp

Filesize
688KB

Download
memory/976-80-0x00000000744E0000-0x0000000074A8B000-memory.dmp

Filesize
5.7MB

Download
memory/976-59-0x0000000000000000-mapping.dmp

Download
memory/976-81-0x00000000744E0000-0x0000000074A8B000-memory.dmp

Filesize
5.7MB

Download
memory/1308-60-0x0000000000000000-mapping.dmp

Download
memory/1732-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1732-69-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1732-71-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1732-70-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1732-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1732-74-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1732-75-0x000000000040242D-mapping.dmp

Download
memory/1732-78-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1732-79-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1732-67-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1732-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1732-82-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads