netwire | 24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2

General

Target

24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2.exe
Size

674KB
MD5

2cd95a575ac673ca3a5304dba4a40174
SHA1

a06e4f812f7ab7e3be1e131a9c792d43f6b5e9ca
SHA256

24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2
SHA512

8051c4949088ba1653976ca1c956a4252f072c34eaf6eec456b4682ab2d977997670adc4b8fbbc72a38e04019971bd35285d7b9b1fd7e2b94abe4419818a8551
SSDEEP

12288:UKCvgpGoqZyO7D79psKFCeAvAHqd82dDOUSViSdUA0T1EkNH:UOp7eAvXW2dD+cSdyEkNH

Score

10^/10

netwire botnet persistence rat stealer upx

Malware Config

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1904-60-0x0000000000400000-0x0000000000422000-memory.dmp	netwire
behavioral1/memory/1668-64-0x0000000000400000-0x00000000004AD000-memory.dmp	netwire
behavioral1/memory/1668-65-0x0000000000400000-0x00000000004AD000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

sigcheck.exe

pid process

1668 sigcheck.exe

pid	process
1668	sigcheck.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1904-56-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/1904-60-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/1668-64-0x0000000000400000-0x00000000004AD000-memory.dmp	upx
behavioral1/memory/1668-65-0x0000000000400000-0x00000000004AD000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2.exe

pid process

1904 24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2.exe

pid	process
1904	24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

sigcheck.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	sigcheck.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\sigcheck = "C:\\Users\\Admin\\AppData\\Roaming\\sigcheck\\sigcheck.exe"	sigcheck.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2.exesigcheck.exe

pid process

1904 24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2.exe
1668 sigcheck.exe

pid	process
1904	24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2.exe
1668	sigcheck.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2.exe

description	pid	process	target process
PID 1904 wrote to memory of 1668	1904	24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2.exe	sigcheck.exe
PID 1904 wrote to memory of 1668	1904	24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2.exe	sigcheck.exe
PID 1904 wrote to memory of 1668	1904	24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2.exe	sigcheck.exe
PID 1904 wrote to memory of 1668	1904	24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2.exe	sigcheck.exe

C:\Users\Admin\AppData\Local\Temp\24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2.exe
"C:\Users\Admin\AppData\Local\Temp\24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1904

C:\Users\Admin\AppData\Roaming\sigcheck\sigcheck.exe
"C:\Users\Admin\AppData\Roaming\sigcheck\sigcheck.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of UnmapMainImage
PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\sigcheck\sigcheck.exe

Filesize
674KB

MD5
2cd95a575ac673ca3a5304dba4a40174

SHA1
a06e4f812f7ab7e3be1e131a9c792d43f6b5e9ca

SHA256
24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2

SHA512
8051c4949088ba1653976ca1c956a4252f072c34eaf6eec456b4682ab2d977997670adc4b8fbbc72a38e04019971bd35285d7b9b1fd7e2b94abe4419818a8551

Download Submit
\Users\Admin\AppData\Roaming\sigcheck\sigcheck.exe

Filesize
674KB

MD5
2cd95a575ac673ca3a5304dba4a40174

SHA1
a06e4f812f7ab7e3be1e131a9c792d43f6b5e9ca

SHA256
24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2

SHA512
8051c4949088ba1653976ca1c956a4252f072c34eaf6eec456b4682ab2d977997670adc4b8fbbc72a38e04019971bd35285d7b9b1fd7e2b94abe4419818a8551

Download Submit
memory/1668-58-0x0000000000000000-mapping.dmp

Download
memory/1668-64-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1668-65-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1904-54-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download
memory/1904-55-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1904-56-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1904-60-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1904-62-0x0000000000230000-0x000000000023A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads