netwire | 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac

General

Target

9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
Size

806KB
MD5

aa8ac68af525eb1805fd80d36390524f
SHA1

fa2aec1760fe268813de00e4dbb2a6fb4f06e973
SHA256

9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac
SHA512

ae7ecb9c33cfab7588aaf7af498a500c2d532febf257407abd95c6d88cfeb18b3e1cacf96e15d224a11c824e623e957fc381d36f5fdb96e3892f643cad8a5c41
SSDEEP

12288:zhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4a0nRBMvJ2dHsabd:5RmJkcoQricOIQxiZY1ia0nRBMkdd

Score

10^/10

netwire botnet rat stealer upx

Malware Config

Signatures

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/320-80-0x0000000000400000-0x0000000000422000-memory.dmp	netwire
behavioral1/memory/320-81-0x0000000000400000-0x0000000000422000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1724-59-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral1/memory/1724-62-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral1/memory/1724-61-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral1/memory/1724-65-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral1/memory/1724-66-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral1/memory/1724-69-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral1/memory/320-72-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/320-74-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/320-75-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/320-79-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/320-80-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/320-81-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/1724-82-0x0000000000400000-0x0000000000459000-memory.dmp	upx

Drops startup file 1 IoCs

Processes:

9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 2 IoCs

Processes:

9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exevbc.exe

description	pid	process	target process
PID 2008 set thread context of 1724	2008	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe	vbc.exe
PID 1724 set thread context of 320	1724	vbc.exe	vbc.exe

Drops file in Windows directory 2 IoCs

Processes:

vbc.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier	vbc.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exevbc.exe

pid	process
2008	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
2008	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
2008	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
2008	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
1724	vbc.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe

pid	process
1280	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
1280	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
1280	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
2008	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
2008	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
2008	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe

Suspicious use of SendNotifyMessage 6 IoCs

Processes:

9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe

pid	process
1280	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
1280	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
1280	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
2008	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
2008	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
2008	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

1724 vbc.exe

pid	process
1724	vbc.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exevbc.exe

description	pid	process	target process
PID 1280 wrote to memory of 2008	1280	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
PID 1280 wrote to memory of 2008	1280	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
PID 1280 wrote to memory of 2008	1280	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
PID 1280 wrote to memory of 2008	1280	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
PID 2008 wrote to memory of 1724	2008	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe	vbc.exe
PID 2008 wrote to memory of 1724	2008	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe	vbc.exe
PID 2008 wrote to memory of 1724	2008	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe	vbc.exe
PID 2008 wrote to memory of 1724	2008	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe	vbc.exe
PID 2008 wrote to memory of 1724	2008	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe	vbc.exe
PID 2008 wrote to memory of 1724	2008	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe	vbc.exe
PID 2008 wrote to memory of 1724	2008	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe	vbc.exe
PID 2008 wrote to memory of 1724	2008	9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe	vbc.exe
PID 1724 wrote to memory of 320	1724	vbc.exe	vbc.exe
PID 1724 wrote to memory of 320	1724	vbc.exe	vbc.exe
PID 1724 wrote to memory of 320	1724	vbc.exe	vbc.exe
PID 1724 wrote to memory of 320	1724	vbc.exe	vbc.exe
PID 1724 wrote to memory of 320	1724	vbc.exe	vbc.exe
PID 1724 wrote to memory of 320	1724	vbc.exe	vbc.exe
PID 1724 wrote to memory of 320	1724	vbc.exe	vbc.exe
PID 1724 wrote to memory of 320	1724	vbc.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
"C:\Users\Admin\AppData\Local\Temp\9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1280

C:\Users\Admin\AppData\Local\Temp\9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
"C:\Users\Admin\AppData\Local\Temp\9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\data.bin"
2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
- Drops file in Windows directory
PID:320

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\data.bin
Filesize
192KB

MD5
0b9aa95f5021d040058ab434b2b5cf03

SHA1
89e31979fa95ab2ef6222e94e2994d068d981dfe

SHA256
c7b801b99dea3571944dcf51d9ada783597703117bf0c20c64add548ecf0a308

SHA512
fd66794edb83e09a1ca743b926e989c87b3b447c2a07225ece2d5944f136c8248c3417e5319306f3645035e590667fdc71164b7b7d4c0ce4b606f206da3523a6

Download Submit
memory/320-72-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/320-81-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/320-80-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/320-79-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/320-76-0x000000000041FFA0-mapping.dmp

Download
memory/320-75-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/320-74-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/320-71-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1280-54-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/1724-62-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1724-69-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1724-66-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1724-65-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1724-61-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1724-63-0x0000000000457830-mapping.dmp

Download
memory/1724-58-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1724-59-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1724-82-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2008-55-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads