netwire | 9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27

General

Target

9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe
Size

136KB
MD5

7583d960f86d86c3fef85bd31d77bf2e
SHA1

e326afcc18f0bc3da0cb17ed4d2c837e59c7c8c1
SHA256

9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27
SHA512

88f0944fd58716d9d3bacd372ff6d2cb08ae7143b115ce17d0c0a4d7935040eb2f334520bb7a1d211f7e27e9e4f4d10c6cbeeadf4e041e58685200927311bde7
SSDEEP

3072:TbLdEFdMbUS7b4WjXugfjhSpkpsJ5bKrmdFUDAMUaTzgV:TxbU2bZHfVSLJ5bKr670

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4608-134-0x0000000000000000-mapping.dmp	netwire
behavioral2/memory/4608-135-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/4608-137-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/4608-138-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{63CQFD68-O63X-K1HU-4N82-K20A56DD54A8}	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{63CQFD68-O63X-K1HU-4N82-K20A56DD54A8}\StubPath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe\""	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\startup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe"	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe

pid process

3364 9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe

pid	process
3364	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe

C:\Users\Admin\AppData\Local\Temp\9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe
"C:\Users\Admin\AppData\Local\Temp\9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364

C:\Users\Admin\AppData\Local\Temp\9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe
"C:\Users\Admin\AppData\Local\Temp\9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe"
2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:4608

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3364-136-0x0000000002220000-0x0000000002226000-memory.dmp

Filesize
24KB

Download
memory/4608-134-0x0000000000000000-mapping.dmp

Download
memory/4608-135-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4608-137-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4608-138-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

description	pid	process	target process
PID 3364 wrote to memory of 4608	3364	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe
PID 3364 wrote to memory of 4608	3364	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe
PID 3364 wrote to memory of 4608	3364	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe
PID 3364 wrote to memory of 4608	3364	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe
PID 3364 wrote to memory of 4608	3364	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe
PID 3364 wrote to memory of 4608	3364	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe
PID 3364 wrote to memory of 4608	3364	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe
PID 3364 wrote to memory of 4608	3364	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe
PID 3364 wrote to memory of 4608	3364	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe
PID 3364 wrote to memory of 4608	3364	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe
PID 3364 wrote to memory of 4608	3364	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe
PID 3364 wrote to memory of 4608	3364	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe
PID 3364 wrote to memory of 4608	3364	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe
PID 3364 wrote to memory of 4608	3364	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe
PID 3364 wrote to memory of 4608	3364	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe	9cbdaaf5be7b7f058eddfbb15394c492ed8b8d1859306c2adac964970c03eb27.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads