netwire | 7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d

General

Target

7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe
Size

468KB
MD5

5375f2896c8fc817fc15ec3d3a1f657d
SHA1

d594ab6cbde3a78bd07e1e0a7fc7c92080e9005b
SHA256

7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d
SHA512

fc4eeabf3e8faf6bd5d5cea7d9e49a9bb9db7253ae1a57afccddd320d181c26878c50dbe41c87105e92d0c730fe7286e0535b269beec4cd8ce1ae43e1759a118
SSDEEP

6144:piOpPXoFc+Em+OUZhSa1+l11KE8gHMl4Ot4geMFY8mwNdLqFVmVPthY+p:cO1WcHm+gacP8Jft4g//QAVPth

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2020-81-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/2020-83-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/2020-84-0x0000000000402196-mapping.dmp	netwire
behavioral1/memory/2020-88-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/2020-89-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

SkypeIcon.exewindow update.exe

pid process

1100 SkypeIcon.exe
1232 window update.exe

pid	process
1100	SkypeIcon.exe
1232	window update.exe

Loads dropped DLL 3 IoCs

Processes:

7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exeRegSvcs.exe

pid	process
944	7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe
944	7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe
2020	RegSvcs.exe

Drops file in System32 directory 1 IoCs

Processes:

msdtc.exe

description ioc process

File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe

description	ioc	process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exeRegSvcs.exe

description	pid	process	target process
PID 944 set thread context of 1576	944	7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe	RegSvcs.exe
PID 1576 set thread context of 2020	1576	RegSvcs.exe	RegSvcs.exe

Drops file in Windows directory 1 IoCs

Processes:

msdtc.exe

description ioc process

File opened for modification C:\Windows\DtcInstall.log msdtc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exeRegSvcs.exeRegSvcs.exe

description	pid	process	target process
PID 944 wrote to memory of 1100	944	7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe	SkypeIcon.exe
PID 944 wrote to memory of 1100	944	7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe	SkypeIcon.exe
PID 944 wrote to memory of 1100	944	7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe	SkypeIcon.exe
PID 944 wrote to memory of 1100	944	7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe	SkypeIcon.exe
PID 944 wrote to memory of 1576	944	7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe	RegSvcs.exe
PID 944 wrote to memory of 1576	944	7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe	RegSvcs.exe
PID 944 wrote to memory of 1576	944	7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe	RegSvcs.exe
PID 944 wrote to memory of 1576	944	7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe	RegSvcs.exe
PID 944 wrote to memory of 1576	944	7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe	RegSvcs.exe
PID 944 wrote to memory of 1576	944	7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe	RegSvcs.exe
PID 944 wrote to memory of 1576	944	7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe	RegSvcs.exe
PID 944 wrote to memory of 1576	944	7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe	RegSvcs.exe
PID 944 wrote to memory of 1576	944	7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe	RegSvcs.exe
PID 944 wrote to memory of 1576	944	7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe	RegSvcs.exe
PID 944 wrote to memory of 1576	944	7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe	RegSvcs.exe
PID 944 wrote to memory of 1576	944	7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe	RegSvcs.exe
PID 1576 wrote to memory of 2020	1576	RegSvcs.exe	RegSvcs.exe
PID 1576 wrote to memory of 2020	1576	RegSvcs.exe	RegSvcs.exe
PID 1576 wrote to memory of 2020	1576	RegSvcs.exe	RegSvcs.exe
PID 1576 wrote to memory of 2020	1576	RegSvcs.exe	RegSvcs.exe
PID 1576 wrote to memory of 2020	1576	RegSvcs.exe	RegSvcs.exe
PID 1576 wrote to memory of 2020	1576	RegSvcs.exe	RegSvcs.exe
PID 1576 wrote to memory of 2020	1576	RegSvcs.exe	RegSvcs.exe
PID 1576 wrote to memory of 2020	1576	RegSvcs.exe	RegSvcs.exe
PID 1576 wrote to memory of 2020	1576	RegSvcs.exe	RegSvcs.exe
PID 1576 wrote to memory of 2020	1576	RegSvcs.exe	RegSvcs.exe
PID 1576 wrote to memory of 2020	1576	RegSvcs.exe	RegSvcs.exe
PID 1576 wrote to memory of 2020	1576	RegSvcs.exe	RegSvcs.exe
PID 2020 wrote to memory of 1232	2020	RegSvcs.exe	window update.exe
PID 2020 wrote to memory of 1232	2020	RegSvcs.exe	window update.exe
PID 2020 wrote to memory of 1232	2020	RegSvcs.exe	window update.exe
PID 2020 wrote to memory of 1232	2020	RegSvcs.exe	window update.exe
PID 2020 wrote to memory of 1232	2020	RegSvcs.exe	window update.exe
PID 2020 wrote to memory of 1232	2020	RegSvcs.exe	window update.exe
PID 2020 wrote to memory of 1232	2020	RegSvcs.exe	window update.exe

C:\Users\Admin\AppData\Local\Temp\7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe
"C:\Users\Admin\AppData\Local\Temp\7157951cf71be2b4f577e64e546688ea346630f7c1988d3e5afbf027549ffb0d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:944

C:\Users\Admin\AppData\Local\Temp\SkypeIcon.exe
"C:\Users\Admin\AppData\Local\Temp\SkypeIcon.exe"
2⤵
- Executes dropped EXE
PID:1100

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Roaming\Install\window update.exe
-m "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
4⤵
- Executes dropped EXE
PID:1232

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:1524

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SkypeIcon.exe
Filesize
142KB

MD5
00b0ace97eaa8a8f1cc1867e49b1fe74

SHA1
de074ce41fa91dffca582fd80ac402f874c533fc

SHA256
ef2f4949ad2dc34facf4aa602ffa7cacb0c381f687fc8276400442ccaa51ab53

SHA512
6e2b2e414ef46cad52bc90264135fd3b502b6a2aefef7bfbcf3af85f3918136924814952603c15d53ca0be40ed6bb4e7a5584fafdbbf59bb1ecd2730d1ad28c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\SkypeIcon.exe
Filesize
142KB

MD5
00b0ace97eaa8a8f1cc1867e49b1fe74

SHA1
de074ce41fa91dffca582fd80ac402f874c533fc

SHA256
ef2f4949ad2dc34facf4aa602ffa7cacb0c381f687fc8276400442ccaa51ab53

SHA512
6e2b2e414ef46cad52bc90264135fd3b502b6a2aefef7bfbcf3af85f3918136924814952603c15d53ca0be40ed6bb4e7a5584fafdbbf59bb1ecd2730d1ad28c4

Download Submit
C:\Users\Admin\AppData\Roaming\Install\window update.exe
Filesize
32KB

MD5
d79f070423fdd3f01ce8c2ba3fbbc8ed

SHA1
2f8ed26eb714b4efbe5d7a3167e33ade82c51fd8

SHA256
97bd627ebfc4d40b21ebaaed916a1ba53859520edc99537b37d042a0d5425a5a

SHA512
47bdc8cce5cd308053d9429a512924448e65023d154b798668d1ee8f628c1b548651e968e7c03db4a6770705f382b9e96db246c39f838000924985b53ccaa3db

Download Submit
C:\Users\Admin\AppData\Roaming\Install\window update.exe
Filesize
32KB

MD5
d79f070423fdd3f01ce8c2ba3fbbc8ed

SHA1
2f8ed26eb714b4efbe5d7a3167e33ade82c51fd8

SHA256
97bd627ebfc4d40b21ebaaed916a1ba53859520edc99537b37d042a0d5425a5a

SHA512
47bdc8cce5cd308053d9429a512924448e65023d154b798668d1ee8f628c1b548651e968e7c03db4a6770705f382b9e96db246c39f838000924985b53ccaa3db

Download Submit
\Users\Admin\AppData\Local\Temp\SkypeIcon.exe
Filesize
142KB

MD5
00b0ace97eaa8a8f1cc1867e49b1fe74

SHA1
de074ce41fa91dffca582fd80ac402f874c533fc

SHA256
ef2f4949ad2dc34facf4aa602ffa7cacb0c381f687fc8276400442ccaa51ab53

SHA512
6e2b2e414ef46cad52bc90264135fd3b502b6a2aefef7bfbcf3af85f3918136924814952603c15d53ca0be40ed6bb4e7a5584fafdbbf59bb1ecd2730d1ad28c4

Download Submit
\Users\Admin\AppData\Local\Temp\SkypeIcon.exe
Filesize
142KB

MD5
00b0ace97eaa8a8f1cc1867e49b1fe74

SHA1
de074ce41fa91dffca582fd80ac402f874c533fc

SHA256
ef2f4949ad2dc34facf4aa602ffa7cacb0c381f687fc8276400442ccaa51ab53

SHA512
6e2b2e414ef46cad52bc90264135fd3b502b6a2aefef7bfbcf3af85f3918136924814952603c15d53ca0be40ed6bb4e7a5584fafdbbf59bb1ecd2730d1ad28c4

Download Submit
\Users\Admin\AppData\Roaming\Install\window update.exe
Filesize
32KB

MD5
d79f070423fdd3f01ce8c2ba3fbbc8ed

SHA1
2f8ed26eb714b4efbe5d7a3167e33ade82c51fd8

SHA256
97bd627ebfc4d40b21ebaaed916a1ba53859520edc99537b37d042a0d5425a5a

SHA512
47bdc8cce5cd308053d9429a512924448e65023d154b798668d1ee8f628c1b548651e968e7c03db4a6770705f382b9e96db246c39f838000924985b53ccaa3db

Download Submit
memory/944-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/944-55-0x0000000074000000-0x00000000745AB000-memory.dmp

Filesize
5.7MB

Download
memory/944-70-0x0000000074000000-0x00000000745AB000-memory.dmp

Filesize
5.7MB

Download
memory/1100-58-0x0000000000000000-mapping.dmp

Download
memory/1232-97-0x0000000074000000-0x00000000745AB000-memory.dmp

Filesize
5.7MB

Download
memory/1232-96-0x0000000074000000-0x00000000745AB000-memory.dmp

Filesize
5.7MB

Download
memory/1232-95-0x0000000074000000-0x00000000745AB000-memory.dmp

Filesize
5.7MB

Download
memory/1232-91-0x0000000000000000-mapping.dmp

Download
memory/1576-75-0x0000000073A50000-0x0000000073FFB000-memory.dmp

Filesize
5.7MB

Download
memory/1576-71-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1576-61-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1576-62-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1576-64-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1576-73-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1576-66-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1576-67-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1576-87-0x0000000073A50000-0x0000000073FFB000-memory.dmp

Filesize
5.7MB

Download
memory/1576-68-0x00000000004294CE-mapping.dmp

Download
memory/2020-81-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2020-89-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2020-88-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2020-84-0x0000000000402196-mapping.dmp

Download
memory/2020-83-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2020-79-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2020-77-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2020-76-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads