netwire | c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747

General

Target

c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe
Size

83KB
MD5

6c26db6682e4d7b05aeba40410e7b320
SHA1

b429213dc46e07a268cde87c89ed90dfbf367b81
SHA256

c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747
SHA512

944a139f76f7ccfcee6667cc46f32a45bcd4d6ce187e43612f832696818ef2d32a663d2313182772181cf371940ba810c9aadaa5373335490fc14441c9aad97b
SSDEEP

1536:nwJOoN1oYaoZ5iV685XJPCVX0sXeoaPWBZHqzqrwBICISUdq2ZdRcaomhvCm:nwJ52Y7ZoH5XJaVEsuoaPWrHZhNSE1d/

Score

10^/10

netwire botnet persistence rat stealer upx

Malware Config

Signatures

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/788-65-0x0000000000400000-0x0000000000421000-memory.dmp	netwire
behavioral1/memory/788-66-0x0000000000400000-0x0000000000421000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{72807TK1-F8I8-2L2E-T6RS-D4SI13SM7G7Q}	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{72807TK1-F8I8-2L2E-T6RS-D4SI13SM7G7Q}\StubPath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe\""	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/788-57-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/788-59-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/788-60-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/788-64-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/788-65-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/788-66-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe

pid process

1920 c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe

pid	process
1920	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\default = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe"	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe

description	pid	process	target process
PID 1920 set thread context of 788	1920	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe

description	pid	process	target process
PID 1920 wrote to memory of 788	1920	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe
PID 1920 wrote to memory of 788	1920	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe
PID 1920 wrote to memory of 788	1920	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe
PID 1920 wrote to memory of 788	1920	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe
PID 1920 wrote to memory of 788	1920	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe
PID 1920 wrote to memory of 788	1920	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe
PID 1920 wrote to memory of 788	1920	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe
PID 1920 wrote to memory of 788	1920	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe	c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe

C:\Users\Admin\AppData\Local\Temp\c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe
"C:\Users\Admin\AppData\Local\Temp\c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1920

C:\Users\Admin\AppData\Local\Temp\c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe
"C:\Users\Admin\AppData\Local\Temp\c6315fa80fa609d5f449ebd5c819d6cf0493d63b82d3e0305994572d66d6e747.exe"
2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:788

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsz5D20.tmp\pesetas.dll
Filesize
22KB

MD5
03335eedd55f4e846c30f6e343b79f72

SHA1
d97be693fa21f3e1f75f6aec08c943a5589d0de4

SHA256
0379140a954b9a8cd1be8fa6302a7296af60298b7af77a1e40914f95d012b647

SHA512
2f43d9a46c720ae424354b5082f37422d8add2d0931f628fb8f503de5860c94efd130bf66b61efaf6865984fea573d122ada603af06aec56286cd29d9faf5b18

Download Submit
memory/788-56-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/788-57-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/788-59-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/788-60-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/788-61-0x000000000041FC50-mapping.dmp

Download
memory/788-64-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/788-65-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/788-66-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1920-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads