netwire | 24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2

General

Target

24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2.exe
Size

674KB
MD5

2cd95a575ac673ca3a5304dba4a40174
SHA1

a06e4f812f7ab7e3be1e131a9c792d43f6b5e9ca
SHA256

24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2
SHA512

8051c4949088ba1653976ca1c956a4252f072c34eaf6eec456b4682ab2d977997670adc4b8fbbc72a38e04019971bd35285d7b9b1fd7e2b94abe4419818a8551
SSDEEP

12288:UKCvgpGoqZyO7D79psKFCeAvAHqd82dDOUSViSdUA0T1EkNH:UOp7eAvXW2dD+cSdyEkNH

Score

10^/10

netwire botnet persistence rat stealer upx

Malware Config

Signatures

NetWire RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1256-136-0x0000000000400000-0x0000000000422000-memory.dmp	netwire
behavioral2/memory/908-141-0x0000000000400000-0x00000000004AD000-memory.dmp	netwire
behavioral2/memory/908-142-0x0000000000400000-0x00000000004AD000-memory.dmp	netwire
behavioral2/memory/908-143-0x0000000000400000-0x00000000004AD000-memory.dmp	netwire
behavioral2/memory/908-144-0x0000000000400000-0x00000000004AD000-memory.dmp	netwire
behavioral2/memory/908-145-0x0000000000400000-0x00000000004AD000-memory.dmp	netwire
behavioral2/memory/908-146-0x0000000000400000-0x00000000004AD000-memory.dmp	netwire
behavioral2/memory/908-147-0x0000000000400000-0x00000000004AD000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

sigcheck.exe

pid process

908 sigcheck.exe

pid	process
908	sigcheck.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1256-133-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/1256-136-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/908-141-0x0000000000400000-0x00000000004AD000-memory.dmp	upx
behavioral2/memory/908-142-0x0000000000400000-0x00000000004AD000-memory.dmp	upx
behavioral2/memory/908-143-0x0000000000400000-0x00000000004AD000-memory.dmp	upx
behavioral2/memory/908-144-0x0000000000400000-0x00000000004AD000-memory.dmp	upx
behavioral2/memory/908-145-0x0000000000400000-0x00000000004AD000-memory.dmp	upx
behavioral2/memory/908-146-0x0000000000400000-0x00000000004AD000-memory.dmp	upx
behavioral2/memory/908-147-0x0000000000400000-0x00000000004AD000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

sigcheck.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	sigcheck.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sigcheck = "C:\\Users\\Admin\\AppData\\Roaming\\sigcheck\\sigcheck.exe"	sigcheck.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2.exe

description	pid	process	target process
PID 1256 wrote to memory of 908	1256	24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2.exe	sigcheck.exe
PID 1256 wrote to memory of 908	1256	24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2.exe	sigcheck.exe
PID 1256 wrote to memory of 908	1256	24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2.exe	sigcheck.exe

C:\Users\Admin\AppData\Local\Temp\24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2.exe
"C:\Users\Admin\AppData\Local\Temp\24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1256

C:\Users\Admin\AppData\Roaming\sigcheck\sigcheck.exe
"C:\Users\Admin\AppData\Roaming\sigcheck\sigcheck.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:908

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\sigcheck\sigcheck.exe
Filesize
674KB

MD5
2cd95a575ac673ca3a5304dba4a40174

SHA1
a06e4f812f7ab7e3be1e131a9c792d43f6b5e9ca

SHA256
24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2

SHA512
8051c4949088ba1653976ca1c956a4252f072c34eaf6eec456b4682ab2d977997670adc4b8fbbc72a38e04019971bd35285d7b9b1fd7e2b94abe4419818a8551

Download Submit
C:\Users\Admin\AppData\Roaming\sigcheck\sigcheck.exe
Filesize
674KB

MD5
2cd95a575ac673ca3a5304dba4a40174

SHA1
a06e4f812f7ab7e3be1e131a9c792d43f6b5e9ca

SHA256
24faa7b4b6fe7691a2c97572ec0a7df18896d86bfb03a1fe48c912b77ea35df2

SHA512
8051c4949088ba1653976ca1c956a4252f072c34eaf6eec456b4682ab2d977997670adc4b8fbbc72a38e04019971bd35285d7b9b1fd7e2b94abe4419818a8551

Download Submit
memory/908-142-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/908-134-0x0000000000000000-mapping.dmp

Download
memory/908-139-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/908-141-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/908-143-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/908-144-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/908-145-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/908-146-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/908-147-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1256-138-0x0000000000640000-0x000000000064A000-memory.dmp

Filesize
40KB

Download
memory/1256-133-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1256-136-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1256-132-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads