netwire | 7f26ea3cb1e19751ee9ca317c3b13d44f3877ede7e162e16172c2eced25f21d7

General

Target

tmp.exe
Size

7KB
MD5

27a275b9237315ba8278c5a5c21535a5
SHA1

a029e26da504b3f2d8775f7b0592cca298aa89b2
SHA256

7f26ea3cb1e19751ee9ca317c3b13d44f3877ede7e162e16172c2eced25f21d7
SHA512

8c29a96c5ae1b4690d1f4f5ac348f65144e32235865e69c84c448ec78c837951ecedc2d2dc6adc0b1c5d7b5bbb5d7cd7b6b21134120ce775e11b7df9bc74d56b
SSDEEP

192:p9OSsMuPtyvkusLBkGYM9xyXAVxVwy75HjXEjdtG:p9OSszP48usLiVM9Qej5bodt

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

212.193.30.230:3363

212.193.30.230:3362

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Cantbeme@1
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1740-150-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/1740-152-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/1740-153-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/1740-154-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

tmp.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation tmp.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

tmp.exe

description pid process target process

PID 2492 set thread context of 1740 2492 tmp.exe tmp.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1480 PING.EXE
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exetmp.exe

pid process

4880 powershell.exe
4880 powershell.exe
2492 tmp.exe
2492 tmp.exe
2492 tmp.exe
2492 tmp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tmp.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2492 tmp.exe
Token: SeDebugPrivilege 4880 powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	tmp.exe

description	pid	process	target process
PID 2492 set thread context of 1740	2492	tmp.exe	tmp.exe

pid	process
1480	PING.EXE

pid	process
4880	powershell.exe
4880	powershell.exe
2492	tmp.exe
2492	tmp.exe
2492	tmp.exe
2492	tmp.exe

description	pid	process
Token: SeDebugPrivilege	2492	tmp.exe
Token: SeDebugPrivilege	4880	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

tmp.execmd.exe

description	pid	process	target process
PID 2492 wrote to memory of 5004	2492	tmp.exe	cmd.exe
PID 2492 wrote to memory of 5004	2492	tmp.exe	cmd.exe
PID 2492 wrote to memory of 5004	2492	tmp.exe	cmd.exe
PID 5004 wrote to memory of 1480	5004	cmd.exe	PING.EXE
PID 5004 wrote to memory of 1480	5004	cmd.exe	PING.EXE
PID 5004 wrote to memory of 1480	5004	cmd.exe	PING.EXE
PID 2492 wrote to memory of 4880	2492	tmp.exe	powershell.exe
PID 2492 wrote to memory of 4880	2492	tmp.exe	powershell.exe
PID 2492 wrote to memory of 4880	2492	tmp.exe	powershell.exe
PID 2492 wrote to memory of 3356	2492	tmp.exe	tmp.exe
PID 2492 wrote to memory of 3356	2492	tmp.exe	tmp.exe
PID 2492 wrote to memory of 3356	2492	tmp.exe	tmp.exe
PID 2492 wrote to memory of 5088	2492	tmp.exe	tmp.exe
PID 2492 wrote to memory of 5088	2492	tmp.exe	tmp.exe
PID 2492 wrote to memory of 5088	2492	tmp.exe	tmp.exe
PID 2492 wrote to memory of 1740	2492	tmp.exe	tmp.exe
PID 2492 wrote to memory of 1740	2492	tmp.exe	tmp.exe
PID 2492 wrote to memory of 1740	2492	tmp.exe	tmp.exe
PID 2492 wrote to memory of 1740	2492	tmp.exe	tmp.exe
PID 2492 wrote to memory of 1740	2492	tmp.exe	tmp.exe
PID 2492 wrote to memory of 1740	2492	tmp.exe	tmp.exe
PID 2492 wrote to memory of 1740	2492	tmp.exe	tmp.exe
PID 2492 wrote to memory of 1740	2492	tmp.exe	tmp.exe
PID 2492 wrote to memory of 1740	2492	tmp.exe	tmp.exe
PID 2492 wrote to memory of 1740	2492	tmp.exe	tmp.exe
PID 2492 wrote to memory of 1740	2492	tmp.exe	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping google.com
2⤵
- Suspicious use of WriteProcessMemory
PID:5004

C:\Windows\SysWOW64\PING.EXE
ping google.com
3⤵
- Runs ping.exe
PID:1480

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4880

C:\Users\Admin\AppData\Local\Temp\tmp.exe
C:\Users\Admin\AppData\Local\Temp\tmp.exe
2⤵
PID:3356

C:\Users\Admin\AppData\Local\Temp\tmp.exe
C:\Users\Admin\AppData\Local\Temp\tmp.exe
2⤵
PID:5088

C:\Users\Admin\AppData\Local\Temp\tmp.exe
C:\Users\Admin\AppData\Local\Temp\tmp.exe
2⤵
PID:1740

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1480-137-0x0000000000000000-mapping.dmp

Download
memory/1740-154-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1740-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1740-152-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1740-150-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1740-149-0x0000000000000000-mapping.dmp

Download
memory/2492-132-0x0000000000360000-0x0000000000368000-memory.dmp

Filesize
32KB

Download
memory/2492-133-0x00000000052E0000-0x0000000005884000-memory.dmp

Filesize
5.6MB

Download
memory/2492-134-0x0000000004D30000-0x0000000004DC2000-memory.dmp

Filesize
584KB

Download
memory/2492-135-0x00000000063D0000-0x00000000063DA000-memory.dmp

Filesize
40KB

Download
memory/2492-138-0x0000000008070000-0x0000000008092000-memory.dmp

Filesize
136KB

Download
memory/3356-147-0x0000000000000000-mapping.dmp

Download
memory/4880-144-0x0000000006610000-0x000000000662E000-memory.dmp

Filesize
120KB

Download
memory/4880-145-0x0000000007C80000-0x00000000082FA000-memory.dmp

Filesize
6.5MB

Download
memory/4880-146-0x0000000006AE0000-0x0000000006AFA000-memory.dmp

Filesize
104KB

Download
memory/4880-143-0x0000000006010000-0x0000000006076000-memory.dmp

Filesize
408KB

Download
memory/4880-142-0x0000000005E30000-0x0000000005E96000-memory.dmp

Filesize
408KB

Download
memory/4880-141-0x00000000056D0000-0x0000000005CF8000-memory.dmp

Filesize
6.2MB

Download
memory/4880-140-0x0000000005030000-0x0000000005066000-memory.dmp

Filesize
216KB

Download
memory/4880-139-0x0000000000000000-mapping.dmp

Download
memory/5004-136-0x0000000000000000-mapping.dmp

Download
memory/5088-148-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing