netwire | 257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec

General

Target

257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
Size

134KB
MD5

c1537ed56e98e1d94e45c12a1c3b1c22
SHA1

130a399f36793ba7103b90ab8f0e8fb25521206a
SHA256

257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec
SHA512

fadf810b40365730f01b8740d4a8222f4bc90eb04a44b8b9b2a536e809fda39ed9c7275f3cc1769cfeb4a7e2b3f61092bc5e39bde391eef8933c3a2b4e7f9be9
SSDEEP

3072:OAsj8MBX8s0oXJMqmBF36Z3xOaWgw1o2SOBgkATMa8Xna6cjTbLe:OAsBZKqmj6uyw8OBgjF83anjPS

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1204-61-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1204-63-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1204-64-0x0000000000402196-mapping.dmp	netwire
behavioral1/memory/1204-67-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1204-68-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Loads dropped DLL 1 IoCs

Processes:

257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe

pid process

1424 257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe

pid	process
1424	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe

description	pid	process	target process
PID 1424 set thread context of 1204	1424	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe

description	pid	process	target process
PID 1424 wrote to memory of 1204	1424	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
PID 1424 wrote to memory of 1204	1424	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
PID 1424 wrote to memory of 1204	1424	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
PID 1424 wrote to memory of 1204	1424	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
PID 1424 wrote to memory of 1204	1424	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
PID 1424 wrote to memory of 1204	1424	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
PID 1424 wrote to memory of 1204	1424	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
PID 1424 wrote to memory of 1204	1424	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
PID 1424 wrote to memory of 1204	1424	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe

C:\Users\Admin\AppData\Local\Temp\257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
"C:\Users\Admin\AppData\Local\Temp\257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1424

C:\Users\Admin\AppData\Local\Temp\257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
"C:\Users\Admin\AppData\Local\Temp\257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe"
2⤵
PID:1204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso63F4.tmp\serves.dll
Filesize
11KB

MD5
9576386383f8385402e59e59f8238c97

SHA1
af702cdec6cb3a6e8bfb9b9cdb11db78a9035ed9

SHA256
daab235b0e3e44b9543635a00a1f808b34e60113fe118d6589201b30c4bd419d

SHA512
2e97d3512a2208fbe3e2d53962e891694f4f8fc2775f3a7298a834538d445b7e8cdb01e46aa875cce31a954c1f69dfad6de9dba859ada547f9f5d183d7a45d21

Download Submit
memory/1204-56-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1204-57-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1204-59-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1204-61-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1204-63-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1204-64-0x0000000000402196-mapping.dmp

Download
memory/1204-67-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1204-68-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1424-54-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads