netwire | 464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef

General

Target

464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe
Size

495KB
MD5

0625a11eec4cf2ea408af4bb1da1db67
SHA1

5d0d9aea2a4f9093e35dff127401f1d14051b255
SHA256

464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef
SHA512

509feabb0757d3dbbc271914d86390d215ca420eb5bec4c11a8c8f899918ecdaa87c64a14a3e944a2f1818d2e8b0763d80b88a77bdd0ff40a5a68074451fa65f
SSDEEP

12288:VgDZ0hrDBH+xbPRNOFANn2kScwhvmZ2APfE3UOA:Vi0hJHOPvO6pjmhvmZ2A3l

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 7 IoCs

rat

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\tmp.exe	netwire
\Users\Admin\AppData\Local\Temp\tmp.exe	netwire
C:\Users\Admin\AppData\Local\Temp\tmp.exe	netwire
behavioral1/memory/560-67-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/560-70-0x0000000000402196-mapping.dmp	netwire
behavioral1/memory/560-73-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/560-69-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

tmp.exe

pid process

1316 tmp.exe

pid	process
1316	tmp.exe

Loads dropped DLL 2 IoCs

Processes:

464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe

pid	process
1616	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe
1616	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe

description	pid	process	target process
PID 1616 set thread context of 560	1616	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe

pid	process
1616	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe
1616	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe
1616	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe
1616	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe

description pid process

Token: SeDebugPrivilege 1616 464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe

description	pid	process
Token: SeDebugPrivilege	1616	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe

description	pid	process	target process
PID 1616 wrote to memory of 1316	1616	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe	tmp.exe
PID 1616 wrote to memory of 1316	1616	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe	tmp.exe
PID 1616 wrote to memory of 1316	1616	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe	tmp.exe
PID 1616 wrote to memory of 1316	1616	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe	tmp.exe
PID 1616 wrote to memory of 560	1616	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe
PID 1616 wrote to memory of 560	1616	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe
PID 1616 wrote to memory of 560	1616	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe
PID 1616 wrote to memory of 560	1616	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe
PID 1616 wrote to memory of 560	1616	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe
PID 1616 wrote to memory of 560	1616	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe
PID 1616 wrote to memory of 560	1616	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe
PID 1616 wrote to memory of 560	1616	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe
PID 1616 wrote to memory of 560	1616	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe	464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe

C:\Users\Admin\AppData\Local\Temp\464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe
"C:\Users\Admin\AppData\Local\Temp\464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
- Executes dropped EXE
PID:1316

C:\Users\Admin\AppData\Local\Temp\464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe
C:\Users\Admin\AppData\Local\Temp\464777b68c882db2be320b8f6a8605d01822c5d3afb9fa44e40f5a0264d6e2ef.exe
2⤵
PID:560

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\.Identifier
Filesize
68B

MD5
a0957afbc62b57c5b6694147ad4e3cbf

SHA1
c08116df06d31f1e4f9781e062629787a1f9daaf

SHA256
b3f3532b3b385f47a86076577178ae94d4c2a4878afb55184b6c4124b15ee59e

SHA512
921d3043aac57bdc48f9fbc83a0abd9b72a6bf16bd02477635c023e7a6dd7e05af1e54b8fd982b4084c7312029b01c0ba68dcdeee65c236258b8989dc1ecd0d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp.exe
Filesize
81KB

MD5
2209d66d417cf442c1bc950abd7ad2c4

SHA1
c47e7ed762573a0e1e436ed24c8a477da0721795

SHA256
a15ed411a501180bfd00167f12dcbb739449eeb403b9819d53f0647b681e23f4

SHA512
c63eb1fd172c0f192f05f72bf600f5193ac401ac49018a696b93145861591c9eeb7533c0b617fdec10d8543ba688c448c00b2ab7a1539e17f8662f193aca2c90

Download Submit
\Users\Admin\AppData\Local\Temp\tmp.exe
Filesize
81KB

MD5
2209d66d417cf442c1bc950abd7ad2c4

SHA1
c47e7ed762573a0e1e436ed24c8a477da0721795

SHA256
a15ed411a501180bfd00167f12dcbb739449eeb403b9819d53f0647b681e23f4

SHA512
c63eb1fd172c0f192f05f72bf600f5193ac401ac49018a696b93145861591c9eeb7533c0b617fdec10d8543ba688c448c00b2ab7a1539e17f8662f193aca2c90

Download Submit
\Users\Admin\AppData\Local\Temp\tmp.exe
Filesize
81KB

MD5
2209d66d417cf442c1bc950abd7ad2c4

SHA1
c47e7ed762573a0e1e436ed24c8a477da0721795

SHA256
a15ed411a501180bfd00167f12dcbb739449eeb403b9819d53f0647b681e23f4

SHA512
c63eb1fd172c0f192f05f72bf600f5193ac401ac49018a696b93145861591c9eeb7533c0b617fdec10d8543ba688c448c00b2ab7a1539e17f8662f193aca2c90

Download Submit
memory/560-63-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/560-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/560-65-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/560-67-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/560-70-0x0000000000402196-mapping.dmp

Download
memory/560-73-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/560-69-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/560-75-0x0000000000401000-0x0000000000413000-memory.dmp

Filesize
72KB

Download
memory/1316-59-0x0000000000000000-mapping.dmp

Download
memory/1616-56-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/1616-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1616-55-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/1616-76-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads