netwire | d3dd0f3d4b427de25cc97fc7edbeedb424389ae3e6f50ed7a015c896a6a9130a

Analysis

max time kernel
135s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
10-11-2022 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AUTHORIZATION-FORM.exe
Size

885KB
MD5

e27ae78966913daae0ee311ad3183814
SHA1

ea2f948d948f11a56017c3619660f93cee235046
SHA256

22a7c02eac7f7940eba9afa9ca51a179789e22257ffe87cbab02c15360a9fded
SHA512

1e5f3c2d216eef94b8268526c56acb022dc80c716759fb098aced1ef25e0d00b92d7fa8d1a8769ceca688256d28cd42c9a922fe623529c9184b29aecb9b669d5
SSDEEP

24576:HO/LH9oyLJnMO6sH0VVyiJj374rqVe/t5oyBMRov:uTySOhMqr414mLv

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

podzeye2.duckdns.org:4433

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
lock_executable
false
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1204-145-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/1204-146-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/1204-148-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/1204-151-0x0000000000400000-0x0000000000450000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

AUTHORIZATION-FORM.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation AUTHORIZATION-FORM.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

AUTHORIZATION-FORM.exe

description pid process target process

PID 2864 set thread context of 1204 2864 AUTHORIZATION-FORM.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1500 schtasks.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	AUTHORIZATION-FORM.exe

description	pid	process	target process
PID 2864 set thread context of 1204	2864	AUTHORIZATION-FORM.exe	vbc.exe

pid	process
1500	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

AUTHORIZATION-FORM.exepowershell.exe

pid	process
2864	AUTHORIZATION-FORM.exe
2864	AUTHORIZATION-FORM.exe
2864	AUTHORIZATION-FORM.exe
2864	AUTHORIZATION-FORM.exe
2864	AUTHORIZATION-FORM.exe
2864	AUTHORIZATION-FORM.exe
2864	AUTHORIZATION-FORM.exe
2864	AUTHORIZATION-FORM.exe
2864	AUTHORIZATION-FORM.exe
2864	AUTHORIZATION-FORM.exe
5104	powershell.exe
2864	AUTHORIZATION-FORM.exe
5104	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUTHORIZATION-FORM.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2864 AUTHORIZATION-FORM.exe
Token: SeDebugPrivilege 5104 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2864	AUTHORIZATION-FORM.exe
Token: SeDebugPrivilege	5104	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

AUTHORIZATION-FORM.exe

description	pid	process	target process
PID 2864 wrote to memory of 5104	2864	AUTHORIZATION-FORM.exe	powershell.exe
PID 2864 wrote to memory of 5104	2864	AUTHORIZATION-FORM.exe	powershell.exe
PID 2864 wrote to memory of 5104	2864	AUTHORIZATION-FORM.exe	powershell.exe
PID 2864 wrote to memory of 1500	2864	AUTHORIZATION-FORM.exe	schtasks.exe
PID 2864 wrote to memory of 1500	2864	AUTHORIZATION-FORM.exe	schtasks.exe
PID 2864 wrote to memory of 1500	2864	AUTHORIZATION-FORM.exe	schtasks.exe
PID 2864 wrote to memory of 4080	2864	AUTHORIZATION-FORM.exe	vbc.exe
PID 2864 wrote to memory of 4080	2864	AUTHORIZATION-FORM.exe	vbc.exe
PID 2864 wrote to memory of 4080	2864	AUTHORIZATION-FORM.exe	vbc.exe
PID 2864 wrote to memory of 2160	2864	AUTHORIZATION-FORM.exe	vbc.exe
PID 2864 wrote to memory of 2160	2864	AUTHORIZATION-FORM.exe	vbc.exe
PID 2864 wrote to memory of 2160	2864	AUTHORIZATION-FORM.exe	vbc.exe
PID 2864 wrote to memory of 1204	2864	AUTHORIZATION-FORM.exe	vbc.exe
PID 2864 wrote to memory of 1204	2864	AUTHORIZATION-FORM.exe	vbc.exe
PID 2864 wrote to memory of 1204	2864	AUTHORIZATION-FORM.exe	vbc.exe
PID 2864 wrote to memory of 1204	2864	AUTHORIZATION-FORM.exe	vbc.exe
PID 2864 wrote to memory of 1204	2864	AUTHORIZATION-FORM.exe	vbc.exe
PID 2864 wrote to memory of 1204	2864	AUTHORIZATION-FORM.exe	vbc.exe
PID 2864 wrote to memory of 1204	2864	AUTHORIZATION-FORM.exe	vbc.exe
PID 2864 wrote to memory of 1204	2864	AUTHORIZATION-FORM.exe	vbc.exe
PID 2864 wrote to memory of 1204	2864	AUTHORIZATION-FORM.exe	vbc.exe
PID 2864 wrote to memory of 1204	2864	AUTHORIZATION-FORM.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\AUTHORIZATION-FORM.exe
"C:\Users\Admin\AppData\Local\Temp\AUTHORIZATION-FORM.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gRqNPUVij.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5104

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gRqNPUVij" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7251.tmp"
2⤵
- Creates scheduled task(s)
PID:1500

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:4080

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:2160

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:1204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7251.tmp
Filesize
1KB

MD5
b9905810650000146a1ac5f928bda303

SHA1
ed0ee8814d7fbdabac75685d96bd3aefaa50c202

SHA256
014dda0e37683064f3ff9ef0d48d8ebf9c8af0c9a37ea335510ac37fba8a416f

SHA512
931f00eafa662417a1edc6955f4128f2a8393cf4daa2169cd4e31f9254e73b9a92c53a0b0c1ea461b496f90e40885ea93dcdb2dfcd8a433fc9ec54ddc680af2b

Download Submit
memory/1204-146-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1204-151-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1204-148-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1204-144-0x0000000000000000-mapping.dmp

Download
memory/1204-145-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1500-138-0x0000000000000000-mapping.dmp

Download
memory/2160-143-0x0000000000000000-mapping.dmp

Download
memory/2864-132-0x00000000006F0000-0x00000000007D4000-memory.dmp

Filesize
912KB

Download
memory/2864-136-0x0000000007B90000-0x0000000007C2C000-memory.dmp

Filesize
624KB

Download
memory/2864-133-0x00000000056D0000-0x0000000005C74000-memory.dmp

Filesize
5.6MB

Download
memory/2864-135-0x0000000005190000-0x000000000519A000-memory.dmp

Filesize
40KB

Download
memory/2864-134-0x00000000051C0000-0x0000000005252000-memory.dmp

Filesize
584KB

Download
memory/4080-142-0x0000000000000000-mapping.dmp

Download
memory/5104-141-0x00000000052A0000-0x00000000058C8000-memory.dmp

Filesize
6.2MB

Download
memory/5104-155-0x00000000066F0000-0x000000000670E000-memory.dmp

Filesize
120KB

Download
memory/5104-140-0x0000000004B80000-0x0000000004BB6000-memory.dmp

Filesize
216KB

Download
memory/5104-137-0x0000000000000000-mapping.dmp

Download
memory/5104-150-0x0000000005B60000-0x0000000005BC6000-memory.dmp

Filesize
408KB

Download
memory/5104-149-0x0000000005A80000-0x0000000005AE6000-memory.dmp

Filesize
408KB

Download
memory/5104-152-0x0000000006150000-0x000000000616E000-memory.dmp

Filesize
120KB

Download
memory/5104-153-0x0000000006720000-0x0000000006752000-memory.dmp

Filesize
200KB

Download
memory/5104-154-0x00000000721B0000-0x00000000721FC000-memory.dmp

Filesize
304KB

Download
memory/5104-162-0x0000000007780000-0x0000000007788000-memory.dmp

Filesize
32KB

Download
memory/5104-156-0x0000000007AA0000-0x000000000811A000-memory.dmp

Filesize
6.5MB

Download
memory/5104-157-0x0000000007460000-0x000000000747A000-memory.dmp

Filesize
104KB

Download
memory/5104-158-0x00000000074D0000-0x00000000074DA000-memory.dmp

Filesize
40KB

Download
memory/5104-159-0x00000000076E0000-0x0000000007776000-memory.dmp

Filesize
600KB

Download
memory/5104-160-0x0000000007690000-0x000000000769E000-memory.dmp

Filesize
56KB

Download
memory/5104-161-0x00000000077A0000-0x00000000077BA000-memory.dmp

Filesize
104KB

Download
memory/5104-147-0x00000000058D0000-0x00000000058F2000-memory.dmp

Filesize
136KB

Download