netwire | 6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077

General

Target

6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe
Size

109KB
MD5

7d9ca5f5b423bb33bda60994f81c6716
SHA1

05bc6d26466acb6a9f0eebe7769a3f475dc0c325
SHA256

6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077
SHA512

3fe410bb4e1b3c39633ac2365147c58921c291d0fb8cd85a5fd6cdd8626c5da594085ff6fe4cc2a8863fd0eb41cdc3b8fbf166860c8dca8d7f3de7c69cf626cd
SSDEEP

1536:/muKdaM4TIOyzdZJAISBcBcXUozNxJzcqZj1JJZ6uIS9ySP7oCtAevkw03qz+TB:ilIyjcXtNxJz3Zj1XcNScSDKeM3n

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1468-137-0x0000000000400000-0x0000000000417000-memory.dmp	netwire
behavioral2/memory/3060-152-0x0000000000400000-0x0000000000417000-memory.dmp	netwire
behavioral2/memory/3060-153-0x0000000000400000-0x0000000000417000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 3 IoCs

Processes:

Host.exeHost.exeHost.exe

pid process

536 Host.exe
1848 Host.exe
3060 Host.exe

pid	process
536	Host.exe
1848	Host.exe
3060	Host.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{MG231XXL-1AY5-J754-X6I0-U14N8361Y762}	Host.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{MG231XXL-1AY5-J754-X6I0-U14N8361Y762}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\""	Host.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exeHost.exeHost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mSILlzCwXBSr = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\QJWuPD4.exe\""	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mSILlzCwXBSr = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\QJWuPD4.exe\""	Host.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe"	Host.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exeHost.exe

description	pid	process	target process
PID 3736 set thread context of 1468	3736	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe
PID 536 set thread context of 3060	536	Host.exe	Host.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exeHost.exe

pid	process
3736	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe
3736	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe
3736	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe
3736	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe
536	Host.exe
536	Host.exe
536	Host.exe
536	Host.exe
536	Host.exe
536	Host.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exeHost.exe

description	pid	process
Token: SeDebugPrivilege	3736	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe
Token: SeDebugPrivilege	536	Host.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exeHost.exe

description	pid	process	target process
PID 3736 wrote to memory of 1468	3736	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe
PID 3736 wrote to memory of 1468	3736	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe
PID 3736 wrote to memory of 1468	3736	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe
PID 3736 wrote to memory of 1468	3736	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe
PID 3736 wrote to memory of 1468	3736	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe
PID 3736 wrote to memory of 1468	3736	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe
PID 3736 wrote to memory of 1468	3736	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe
PID 3736 wrote to memory of 1468	3736	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe
PID 1468 wrote to memory of 536	1468	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe	Host.exe
PID 1468 wrote to memory of 536	1468	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe	Host.exe
PID 1468 wrote to memory of 536	1468	6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe	Host.exe
PID 536 wrote to memory of 1848	536	Host.exe	Host.exe
PID 536 wrote to memory of 1848	536	Host.exe	Host.exe
PID 536 wrote to memory of 1848	536	Host.exe	Host.exe
PID 536 wrote to memory of 3060	536	Host.exe	Host.exe
PID 536 wrote to memory of 3060	536	Host.exe	Host.exe
PID 536 wrote to memory of 3060	536	Host.exe	Host.exe
PID 536 wrote to memory of 3060	536	Host.exe	Host.exe
PID 536 wrote to memory of 3060	536	Host.exe	Host.exe
PID 536 wrote to memory of 3060	536	Host.exe	Host.exe
PID 536 wrote to memory of 3060	536	Host.exe	Host.exe
PID 536 wrote to memory of 3060	536	Host.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe
"C:\Users\Admin\AppData\Local\Temp\6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Users\Admin\AppData\Local\Temp\6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe
  "C:\Users\Admin\AppData\Local\Temp\6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Users\Admin\AppData\Roaming\Install\Host.exe
    "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:536
  - - C:\Users\Admin\AppData\Roaming\Install\Host.exe
      "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
      4⤵
      Executes dropped EXE
      PID:1848
  - - C:\Users\Admin\AppData\Roaming\Install\Host.exe
      "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
      4⤵
      Executes dropped EXE
      Modifies Installed Components in the registry
      Adds Run key to start application
      PID:3060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
109KB

MD5
7d9ca5f5b423bb33bda60994f81c6716

SHA1
05bc6d26466acb6a9f0eebe7769a3f475dc0c325

SHA256
6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077

SHA512
3fe410bb4e1b3c39633ac2365147c58921c291d0fb8cd85a5fd6cdd8626c5da594085ff6fe4cc2a8863fd0eb41cdc3b8fbf166860c8dca8d7f3de7c69cf626cd

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
109KB

MD5
7d9ca5f5b423bb33bda60994f81c6716

SHA1
05bc6d26466acb6a9f0eebe7769a3f475dc0c325

SHA256
6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077

SHA512
3fe410bb4e1b3c39633ac2365147c58921c291d0fb8cd85a5fd6cdd8626c5da594085ff6fe4cc2a8863fd0eb41cdc3b8fbf166860c8dca8d7f3de7c69cf626cd

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
109KB

MD5
7d9ca5f5b423bb33bda60994f81c6716

SHA1
05bc6d26466acb6a9f0eebe7769a3f475dc0c325

SHA256
6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077

SHA512
3fe410bb4e1b3c39633ac2365147c58921c291d0fb8cd85a5fd6cdd8626c5da594085ff6fe4cc2a8863fd0eb41cdc3b8fbf166860c8dca8d7f3de7c69cf626cd

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
109KB

MD5
7d9ca5f5b423bb33bda60994f81c6716

SHA1
05bc6d26466acb6a9f0eebe7769a3f475dc0c325

SHA256
6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077

SHA512
3fe410bb4e1b3c39633ac2365147c58921c291d0fb8cd85a5fd6cdd8626c5da594085ff6fe4cc2a8863fd0eb41cdc3b8fbf166860c8dca8d7f3de7c69cf626cd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\QJWuPD4.exe

Filesize
109KB

MD5
7d9ca5f5b423bb33bda60994f81c6716

SHA1
05bc6d26466acb6a9f0eebe7769a3f475dc0c325

SHA256
6910f1b44a3e1b208f34f96df8e553d7b8bcfe1c75ebd0a4e0407eab3e5f8077

SHA512
3fe410bb4e1b3c39633ac2365147c58921c291d0fb8cd85a5fd6cdd8626c5da594085ff6fe4cc2a8863fd0eb41cdc3b8fbf166860c8dca8d7f3de7c69cf626cd

Download Submit
memory/536-151-0x0000000073700000-0x0000000073CB1000-memory.dmp

Filesize
5.7MB

Download
memory/536-142-0x0000000073700000-0x0000000073CB1000-memory.dmp

Filesize
5.7MB

Download
memory/536-139-0x0000000000000000-mapping.dmp

Download
memory/1468-137-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1468-136-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1468-134-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1468-133-0x0000000000000000-mapping.dmp

Download
memory/1848-143-0x0000000000000000-mapping.dmp

Download
memory/3060-145-0x0000000000000000-mapping.dmp

Download
memory/3060-152-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3060-153-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3736-138-0x0000000074870000-0x0000000074E21000-memory.dmp

Filesize
5.7MB

Download
memory/3736-132-0x0000000074870000-0x0000000074E21000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads