netwire | b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a

General

Target

b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe
Size

156KB
MD5

c066281525814a0b9b70842dfba0a728
SHA1

0191c82db08d05a914cc6450206b92bf64270232
SHA256

b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a
SHA512

da77f2c75a4f277d15216a20578fe602be4492dde0b11bf788b3347b3d85d430b05a1a5cb85617da249fa3cb3306a4b778768c63c8cf1bd1081c89c0959a9ff9
SSDEEP

3072:oN++i8L367k7uY+5BaGNQVbls/k+HNwC4zRviN9K:ocC67lfOAQhMTHNws

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1752-134-0x0000000000000000-mapping.dmp	netwire
behavioral2/memory/1752-135-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/1752-138-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/1752-139-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{QEFI6MD4-2J84-6AEO-0572-0M0V56652NB5}	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{QEFI6MD4-2J84-6AEO-0572-0M0V56652NB5}\StubPath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe\""	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upload = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe"	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe

description	pid	process	target process
PID 4636 set thread context of 1752	4636	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe

pid process

4636 b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe

pid	process
4636	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe

description	pid	process	target process
PID 4636 wrote to memory of 1752	4636	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe
PID 4636 wrote to memory of 1752	4636	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe
PID 4636 wrote to memory of 1752	4636	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe
PID 4636 wrote to memory of 1752	4636	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe
PID 4636 wrote to memory of 1752	4636	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe
PID 4636 wrote to memory of 1752	4636	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe
PID 4636 wrote to memory of 1752	4636	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe
PID 4636 wrote to memory of 1752	4636	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe
PID 4636 wrote to memory of 1752	4636	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe
PID 4636 wrote to memory of 1752	4636	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe	b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe

C:\Users\Admin\AppData\Local\Temp\b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe
"C:\Users\Admin\AppData\Local\Temp\b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636

C:\Users\Admin\AppData\Local\Temp\b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe
"C:\Users\Admin\AppData\Local\Temp\b79dae4f637d5de6f2fbbf5792ee32722855966a72f0a5cf674a1f972da5af4a.exe"
2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:1752

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-134-0x0000000000000000-mapping.dmp

Download
memory/1752-135-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1752-138-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1752-139-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4636-136-0x00000000006E0000-0x00000000006E6000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads