netwire | 8f24221caef706d4502572968c0cf1317e632ebcb64157a5a1dafbdde7fc642c

General

Target

Payment Slip.exe
Size

665KB
MD5

34dd3c65abeca163b3347a7623d5dfa9
SHA1

439b3d605cdbfbd34d9d9f66c9c4851dfd41fc25
SHA256

8f24221caef706d4502572968c0cf1317e632ebcb64157a5a1dafbdde7fc642c
SHA512

769e85ac91e207fdb5118b8da6b4d62152e3f18b59dbb3d8136f44bfe38200f4dea27d0c44183b2583cfdf22622cca81831fd201ec2cc200881fc0cc17179d47
SSDEEP

12288:1T6whuJ/Qvhzps7225LN2/4c2J8skPiTMLEF00WlCJm19H2n7T9jFPuUTi8DPN/P:nuJIs7229N2/O8sMBwF00WlC09H0T9jd

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

zonedx.ddns.net:3360

85.209.134.105:3360

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
true
offline_keylogger
true
password
Password9090
registry_autorun
true
startup_name
NetWire
use_mutex
false

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3888-145-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/3888-147-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/3888-152-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Payment Slip.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Payment Slip.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Payment Slip.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Payment Slip.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Payment Slip.exe"	Payment Slip.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Payment Slip.exe

description pid process target process

PID 4736 set thread context of 3888 4736 Payment Slip.exe Payment Slip.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3672 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Payment Slip.exepowershell.exe

pid process

4736 Payment Slip.exe
4736 Payment Slip.exe
4736 Payment Slip.exe
4736 Payment Slip.exe
3036 powershell.exe
3036 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Payment Slip.exepowershell.exe

description pid process

Token: SeDebugPrivilege 4736 Payment Slip.exe
Token: SeDebugPrivilege 3036 powershell.exe

description	pid	process	target process
PID 4736 set thread context of 3888	4736	Payment Slip.exe	Payment Slip.exe

pid	process
3672	schtasks.exe

pid	process
4736	Payment Slip.exe
4736	Payment Slip.exe
4736	Payment Slip.exe
4736	Payment Slip.exe
3036	powershell.exe
3036	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4736	Payment Slip.exe
Token: SeDebugPrivilege	3036	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

Payment Slip.exe

description	pid	process	target process
PID 4736 wrote to memory of 3036	4736	Payment Slip.exe	powershell.exe
PID 4736 wrote to memory of 3036	4736	Payment Slip.exe	powershell.exe
PID 4736 wrote to memory of 3036	4736	Payment Slip.exe	powershell.exe
PID 4736 wrote to memory of 3672	4736	Payment Slip.exe	schtasks.exe
PID 4736 wrote to memory of 3672	4736	Payment Slip.exe	schtasks.exe
PID 4736 wrote to memory of 3672	4736	Payment Slip.exe	schtasks.exe
PID 4736 wrote to memory of 4404	4736	Payment Slip.exe	Payment Slip.exe
PID 4736 wrote to memory of 4404	4736	Payment Slip.exe	Payment Slip.exe
PID 4736 wrote to memory of 4404	4736	Payment Slip.exe	Payment Slip.exe
PID 4736 wrote to memory of 1316	4736	Payment Slip.exe	Payment Slip.exe
PID 4736 wrote to memory of 1316	4736	Payment Slip.exe	Payment Slip.exe
PID 4736 wrote to memory of 1316	4736	Payment Slip.exe	Payment Slip.exe
PID 4736 wrote to memory of 3888	4736	Payment Slip.exe	Payment Slip.exe
PID 4736 wrote to memory of 3888	4736	Payment Slip.exe	Payment Slip.exe
PID 4736 wrote to memory of 3888	4736	Payment Slip.exe	Payment Slip.exe
PID 4736 wrote to memory of 3888	4736	Payment Slip.exe	Payment Slip.exe
PID 4736 wrote to memory of 3888	4736	Payment Slip.exe	Payment Slip.exe
PID 4736 wrote to memory of 3888	4736	Payment Slip.exe	Payment Slip.exe
PID 4736 wrote to memory of 3888	4736	Payment Slip.exe	Payment Slip.exe
PID 4736 wrote to memory of 3888	4736	Payment Slip.exe	Payment Slip.exe
PID 4736 wrote to memory of 3888	4736	Payment Slip.exe	Payment Slip.exe
PID 4736 wrote to memory of 3888	4736	Payment Slip.exe	Payment Slip.exe
PID 4736 wrote to memory of 3888	4736	Payment Slip.exe	Payment Slip.exe

C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hLjugFXbb.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hLjugFXbb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1BF4.tmp"
2⤵
- Creates scheduled task(s)
PID:3672

C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"
2⤵
- Adds Run key to start application
PID:3888

C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"
2⤵
PID:1316

C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"
2⤵
PID:4404

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1BF4.tmp
Filesize
1KB

MD5
f763427e25d11239a8feb4cf6f48fcf7

SHA1
9c27f41b216f7be143f867dd85ddb7829568ae86

SHA256
216b0053310c1f0df9ff70898e2f0b0066e047ed57eddd4947816b27386bd214

SHA512
2a87c01ca1cca276b6961fc85bddb67bae491ff9b0650037c16a602d15b3745b89a092a8bf58452569b82cba6c044a570d4760e6d86919bcda63114a1a5325bf

Download Submit
memory/1316-142-0x0000000000000000-mapping.dmp

Download
memory/3036-148-0x0000000005770000-0x0000000005792000-memory.dmp

Filesize
136KB

Download
memory/3036-153-0x0000000006E10000-0x0000000006E42000-memory.dmp

Filesize
200KB

Download
memory/3036-161-0x0000000007E90000-0x0000000007EAA000-memory.dmp

Filesize
104KB

Download
memory/3036-137-0x0000000000000000-mapping.dmp

Download
memory/3036-159-0x0000000007DD0000-0x0000000007E66000-memory.dmp

Filesize
600KB

Download
memory/3036-139-0x0000000002F20000-0x0000000002F56000-memory.dmp

Filesize
216KB

Download
memory/3036-158-0x0000000007BC0000-0x0000000007BCA000-memory.dmp

Filesize
40KB

Download
memory/3036-157-0x0000000007B50000-0x0000000007B6A000-memory.dmp

Filesize
104KB

Download
memory/3036-156-0x0000000008190000-0x000000000880A000-memory.dmp

Filesize
6.5MB

Download
memory/3036-143-0x0000000005BC0000-0x00000000061E8000-memory.dmp

Filesize
6.2MB

Download
memory/3036-155-0x0000000006DF0000-0x0000000006E0E000-memory.dmp

Filesize
120KB

Download
memory/3036-149-0x0000000005B20000-0x0000000005B86000-memory.dmp

Filesize
408KB

Download
memory/3036-162-0x0000000007E70000-0x0000000007E78000-memory.dmp

Filesize
32KB

Download
memory/3036-160-0x0000000007D80000-0x0000000007D8E000-memory.dmp

Filesize
56KB

Download
memory/3036-154-0x00000000707F0000-0x000000007083C000-memory.dmp

Filesize
304KB

Download
memory/3036-150-0x0000000006360000-0x00000000063C6000-memory.dmp

Filesize
408KB

Download
memory/3036-151-0x0000000006840000-0x000000000685E000-memory.dmp

Filesize
120KB

Download
memory/3672-138-0x0000000000000000-mapping.dmp

Download
memory/3888-152-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3888-147-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3888-144-0x0000000000000000-mapping.dmp

Download
memory/3888-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4404-141-0x0000000000000000-mapping.dmp

Download
memory/4736-135-0x0000000007980000-0x000000000798A000-memory.dmp

Filesize
40KB

Download
memory/4736-133-0x0000000007ED0000-0x0000000008474000-memory.dmp

Filesize
5.6MB

Download
memory/4736-134-0x00000000079C0000-0x0000000007A52000-memory.dmp

Filesize
584KB

Download
memory/4736-136-0x000000000A330000-0x000000000A3CC000-memory.dmp

Filesize
624KB

Download
memory/4736-132-0x0000000000A70000-0x0000000000B1C000-memory.dmp

Filesize
688KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads