netwire | f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d

General

Target

f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe
Size

875KB
MD5

9e31a336dd9e73df1cabf3d3b8e3d489
SHA1

349253da2192e6c146631bbf9566d06430b015bf
SHA256

f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d
SHA512

0e25b7ada6d67c4c98a4105c959b6888adda10fe123f35d720364ccb361efa5ca8e863700ee9aaa86bd3536306396ec13fa61d2885ff8f84957e85a11a9ba6cd
SSDEEP

12288:caWzgMg7v3qnCiMErQohh0F4CCJ8lny/QswI0+u0DrvssN8q:jaHMv6Corjqny/QNI0+VXssKq

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1340-69-0x0000000000400000-0x0000000000417000-memory.dmp	netwire
behavioral1/memory/2032-84-0x0000000000400000-0x0000000000417000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

Host.exeHost.exe

pid process

1708 Host.exe
2032 Host.exe

pid	process
1708	Host.exe
2032	Host.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{XTV2TOCI-0048-CP6U-0UC5-5FV14W0LO46U}	Host.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{XTV2TOCI-0048-CP6U-0UC5-5FV14W0LO46U}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\""	Host.exe

Loads dropped DLL 1 IoCs

Processes:

f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe

pid process

1340 f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe

pid	process
1340	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe"	Host.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Install\Host.exe	autoit_exe
C:\Users\Admin\AppData\Roaming\Install\Host.exe	autoit_exe
C:\Users\Admin\AppData\Roaming\Install\Host.exe	autoit_exe
C:\Users\Admin\AppData\Roaming\Install\Host.exe	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exeHost.exe

description	pid	process	target process
PID 1536 set thread context of 1340	1536	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe
PID 1708 set thread context of 2032	1708	Host.exe	Host.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exeHost.exe

pid	process
1536	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe
1536	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe
1536	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe
1708	Host.exe
1708	Host.exe
1708	Host.exe

Suspicious use of SendNotifyMessage 6 IoCs

Processes:

f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exeHost.exe

pid	process
1536	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe
1536	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe
1536	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe
1708	Host.exe
1708	Host.exe
1708	Host.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exef176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exeHost.exe

description	pid	process	target process
PID 1536 wrote to memory of 1340	1536	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe
PID 1536 wrote to memory of 1340	1536	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe
PID 1536 wrote to memory of 1340	1536	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe
PID 1536 wrote to memory of 1340	1536	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe
PID 1536 wrote to memory of 1340	1536	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe
PID 1536 wrote to memory of 1340	1536	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe
PID 1536 wrote to memory of 1340	1536	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe
PID 1536 wrote to memory of 1340	1536	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe
PID 1340 wrote to memory of 1708	1340	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe	Host.exe
PID 1340 wrote to memory of 1708	1340	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe	Host.exe
PID 1340 wrote to memory of 1708	1340	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe	Host.exe
PID 1340 wrote to memory of 1708	1340	f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe	Host.exe
PID 1708 wrote to memory of 2032	1708	Host.exe	Host.exe
PID 1708 wrote to memory of 2032	1708	Host.exe	Host.exe
PID 1708 wrote to memory of 2032	1708	Host.exe	Host.exe
PID 1708 wrote to memory of 2032	1708	Host.exe	Host.exe
PID 1708 wrote to memory of 2032	1708	Host.exe	Host.exe
PID 1708 wrote to memory of 2032	1708	Host.exe	Host.exe
PID 1708 wrote to memory of 2032	1708	Host.exe	Host.exe
PID 1708 wrote to memory of 2032	1708	Host.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe
"C:\Users\Admin\AppData\Local\Temp\f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1536

C:\Users\Admin\AppData\Local\Temp\f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe
"C:\Users\Admin\AppData\Local\Temp\f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1340

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe" -m C:\Users\Admin\AppData\Local\Temp\f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1708

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:2032

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
875KB

MD5
9e31a336dd9e73df1cabf3d3b8e3d489

SHA1
349253da2192e6c146631bbf9566d06430b015bf

SHA256
f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d

SHA512
0e25b7ada6d67c4c98a4105c959b6888adda10fe123f35d720364ccb361efa5ca8e863700ee9aaa86bd3536306396ec13fa61d2885ff8f84957e85a11a9ba6cd

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
875KB

MD5
9e31a336dd9e73df1cabf3d3b8e3d489

SHA1
349253da2192e6c146631bbf9566d06430b015bf

SHA256
f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d

SHA512
0e25b7ada6d67c4c98a4105c959b6888adda10fe123f35d720364ccb361efa5ca8e863700ee9aaa86bd3536306396ec13fa61d2885ff8f84957e85a11a9ba6cd

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
875KB

MD5
9e31a336dd9e73df1cabf3d3b8e3d489

SHA1
349253da2192e6c146631bbf9566d06430b015bf

SHA256
f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d

SHA512
0e25b7ada6d67c4c98a4105c959b6888adda10fe123f35d720364ccb361efa5ca8e863700ee9aaa86bd3536306396ec13fa61d2885ff8f84957e85a11a9ba6cd

Download Submit
\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
875KB

MD5
9e31a336dd9e73df1cabf3d3b8e3d489

SHA1
349253da2192e6c146631bbf9566d06430b015bf

SHA256
f176551008ead792dc4d981c0b1c2ad48f3f2bab30fb76fb62264c096f11739d

SHA512
0e25b7ada6d67c4c98a4105c959b6888adda10fe123f35d720364ccb361efa5ca8e863700ee9aaa86bd3536306396ec13fa61d2885ff8f84957e85a11a9ba6cd

Download Submit
memory/1340-60-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1340-62-0x0000000000401F8F-mapping.dmp

Download
memory/1340-61-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1340-65-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1340-69-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1340-55-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1340-58-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1340-56-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1536-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1708-67-0x0000000000000000-mapping.dmp

Download
memory/2032-79-0x0000000000401F8F-mapping.dmp

Download
memory/2032-84-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads