netwire | 257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec

Analysis

max time kernel
339s
max time network
401s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
Size

134KB
MD5

c1537ed56e98e1d94e45c12a1c3b1c22
SHA1

130a399f36793ba7103b90ab8f0e8fb25521206a
SHA256

257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec
SHA512

fadf810b40365730f01b8740d4a8222f4bc90eb04a44b8b9b2a536e809fda39ed9c7275f3cc1769cfeb4a7e2b3f61092bc5e39bde391eef8933c3a2b4e7f9be9
SSDEEP

3072:OAsj8MBX8s0oXJMqmBF36Z3xOaWgw1o2SOBgkATMa8Xna6cjTbLe:OAsBZKqmj6uyw8OBgjF83anjPS

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3384-134-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/3384-136-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/3384-137-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Loads dropped DLL 1 IoCs

Processes:

257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe

pid process

4804 257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe

pid	process
4804	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe

description	pid	process	target process
PID 4804 set thread context of 3384	4804	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe

description	pid	process	target process
PID 4804 wrote to memory of 3384	4804	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
PID 4804 wrote to memory of 3384	4804	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
PID 4804 wrote to memory of 3384	4804	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
PID 4804 wrote to memory of 3384	4804	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
PID 4804 wrote to memory of 3384	4804	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
PID 4804 wrote to memory of 3384	4804	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
PID 4804 wrote to memory of 3384	4804	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
PID 4804 wrote to memory of 3384	4804	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
PID 4804 wrote to memory of 3384	4804	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe	257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe

C:\Users\Admin\AppData\Local\Temp\257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
"C:\Users\Admin\AppData\Local\Temp\257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4804

C:\Users\Admin\AppData\Local\Temp\257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe
"C:\Users\Admin\AppData\Local\Temp\257725af298340e45ae63a2137b9b33e6cbc9ef4e50d17ce66d1c67ed7dd7dec.exe"
2⤵
PID:3384

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsvA7AD.tmp\serves.dll
Filesize
11KB

MD5
9576386383f8385402e59e59f8238c97

SHA1
af702cdec6cb3a6e8bfb9b9cdb11db78a9035ed9

SHA256
daab235b0e3e44b9543635a00a1f808b34e60113fe118d6589201b30c4bd419d

SHA512
2e97d3512a2208fbe3e2d53962e891694f4f8fc2775f3a7298a834538d445b7e8cdb01e46aa875cce31a954c1f69dfad6de9dba859ada547f9f5d183d7a45d21

Download Submit
memory/3384-133-0x0000000000000000-mapping.dmp

Download
memory/3384-134-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3384-136-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3384-137-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download