netwire | 45ee3a5d71c285e1ae16338c3e05340431688ddc30f472545b29e2ca990899db

Analysis

max time kernel
135s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 04:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45ee3a5d71c285e1ae16338c3e05340431688ddc30f472545b29e2ca990899db.exe
Size

254KB
MD5

a9524724dd9b85732a26e83e389c9260
SHA1

dba573cd64033171e106b26e9cc7bae751daec52
SHA256

45ee3a5d71c285e1ae16338c3e05340431688ddc30f472545b29e2ca990899db
SHA512

eeb4744805a8f54f847bbc7c92a6a59cfa0c9a824cee99b9bbe193b0b46e205f7fabecf93aa230563ab3842abbc16d2ef37e55bea41e1e259d2669957bbe88ca
SSDEEP

6144:uQhv4lR7FU4HZkdXuAPUbXKp1K+EIIDc4Z:uQhv43qckdXuHbap1YtDc4Z

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3016-135-0x0000000000400000-0x0000000000446000-memory.dmp	netwire
behavioral2/memory/3660-136-0x0000000000400000-0x0000000000446000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

Acrobat Reader.exe

pid process

3660 Acrobat Reader.exe

pid	process
3660	Acrobat Reader.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Acrobat Reader.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Acrobat Reader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Acrobat Reader = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Acrobat Reader.exe"	Acrobat Reader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

45ee3a5d71c285e1ae16338c3e05340431688ddc30f472545b29e2ca990899db.exeAcrobat Reader.exe

pid process

3016 45ee3a5d71c285e1ae16338c3e05340431688ddc30f472545b29e2ca990899db.exe
3660 Acrobat Reader.exe

pid	process
3016	45ee3a5d71c285e1ae16338c3e05340431688ddc30f472545b29e2ca990899db.exe
3660	Acrobat Reader.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

45ee3a5d71c285e1ae16338c3e05340431688ddc30f472545b29e2ca990899db.exe

description	pid	process	target process
PID 3016 wrote to memory of 3660	3016	45ee3a5d71c285e1ae16338c3e05340431688ddc30f472545b29e2ca990899db.exe	Acrobat Reader.exe
PID 3016 wrote to memory of 3660	3016	45ee3a5d71c285e1ae16338c3e05340431688ddc30f472545b29e2ca990899db.exe	Acrobat Reader.exe
PID 3016 wrote to memory of 3660	3016	45ee3a5d71c285e1ae16338c3e05340431688ddc30f472545b29e2ca990899db.exe	Acrobat Reader.exe

C:\Users\Admin\AppData\Local\Temp\45ee3a5d71c285e1ae16338c3e05340431688ddc30f472545b29e2ca990899db.exe
"C:\Users\Admin\AppData\Local\Temp\45ee3a5d71c285e1ae16338c3e05340431688ddc30f472545b29e2ca990899db.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3016

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat Reader.exe
-m "C:\Users\Admin\AppData\Local\Temp\45ee3a5d71c285e1ae16338c3e05340431688ddc30f472545b29e2ca990899db.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3660

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat Reader.exe
Filesize
254KB

MD5
a9524724dd9b85732a26e83e389c9260

SHA1
dba573cd64033171e106b26e9cc7bae751daec52

SHA256
45ee3a5d71c285e1ae16338c3e05340431688ddc30f472545b29e2ca990899db

SHA512
eeb4744805a8f54f847bbc7c92a6a59cfa0c9a824cee99b9bbe193b0b46e205f7fabecf93aa230563ab3842abbc16d2ef37e55bea41e1e259d2669957bbe88ca

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat Reader.exe
Filesize
254KB

MD5
a9524724dd9b85732a26e83e389c9260

SHA1
dba573cd64033171e106b26e9cc7bae751daec52

SHA256
45ee3a5d71c285e1ae16338c3e05340431688ddc30f472545b29e2ca990899db

SHA512
eeb4744805a8f54f847bbc7c92a6a59cfa0c9a824cee99b9bbe193b0b46e205f7fabecf93aa230563ab3842abbc16d2ef37e55bea41e1e259d2669957bbe88ca

Download Submit
memory/3016-135-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3660-132-0x0000000000000000-mapping.dmp

Download
memory/3660-136-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download