netwire | bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651

General

Target

bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
Size

447KB
MD5

754411f368178a09f54d05158e7e17a3
SHA1

b781c408c69827af768eeca418f564e14eaf5eaf
SHA256

bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651
SHA512

5d2083dbfc24efa11608ba443a8f2468685a11bda1502fed1c2774e737d64813f26723d8c8d16904cfe616746ad167b34c5c50936faf516934b6bcab113f8c7a
SSDEEP

6144:Wjjf/HVuwmguK4Fsz+XqfwXmP/R8evOYVw:WX1uJeu6fYg8evOYVw

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3000-135-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/3000-137-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/3000-144-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/2040-160-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 3 IoCs

Processes:

BrokerInfrastructure.exeAudioEndpointBuilder.exeBrokerInfrastructure.exe

pid process

1864 BrokerInfrastructure.exe
3224 AudioEndpointBuilder.exe
112 BrokerInfrastructure.exe

pid	process
1864	BrokerInfrastructure.exe
3224	AudioEndpointBuilder.exe
112	BrokerInfrastructure.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AudioEndpointBuilder.exebbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	AudioEndpointBuilder.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 2 IoCs

Processes:

bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exeAudioEndpointBuilder.exe

description	pid	process	target process
PID 4576 set thread context of 3000	4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe	vbc.exe
PID 3224 set thread context of 2040	3224	AudioEndpointBuilder.exe	vbc.exe

Drops file in Windows directory 3 IoCs

Processes:

vbc.exevbc.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier	vbc.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier	vbc.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exeBrokerInfrastructure.exe

pid	process
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe
4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
1864	BrokerInfrastructure.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exeBrokerInfrastructure.exeAudioEndpointBuilder.exeBrokerInfrastructure.exe

description	pid	process
Token: SeDebugPrivilege	4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
Token: SeDebugPrivilege	1864	BrokerInfrastructure.exe
Token: SeDebugPrivilege	3224	AudioEndpointBuilder.exe
Token: SeDebugPrivilege	112	BrokerInfrastructure.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exeBrokerInfrastructure.exeAudioEndpointBuilder.exe

description	pid	process	target process
PID 4576 wrote to memory of 3000	4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe	vbc.exe
PID 4576 wrote to memory of 3000	4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe	vbc.exe
PID 4576 wrote to memory of 3000	4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe	vbc.exe
PID 4576 wrote to memory of 3000	4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe	vbc.exe
PID 4576 wrote to memory of 3000	4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe	vbc.exe
PID 4576 wrote to memory of 3000	4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe	vbc.exe
PID 4576 wrote to memory of 3000	4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe	vbc.exe
PID 4576 wrote to memory of 3000	4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe	vbc.exe
PID 4576 wrote to memory of 1864	4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe	BrokerInfrastructure.exe
PID 4576 wrote to memory of 1864	4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe	BrokerInfrastructure.exe
PID 4576 wrote to memory of 1864	4576	bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe	BrokerInfrastructure.exe
PID 1864 wrote to memory of 3224	1864	BrokerInfrastructure.exe	AudioEndpointBuilder.exe
PID 1864 wrote to memory of 3224	1864	BrokerInfrastructure.exe	AudioEndpointBuilder.exe
PID 1864 wrote to memory of 3224	1864	BrokerInfrastructure.exe	AudioEndpointBuilder.exe
PID 3224 wrote to memory of 2040	3224	AudioEndpointBuilder.exe	vbc.exe
PID 3224 wrote to memory of 2040	3224	AudioEndpointBuilder.exe	vbc.exe
PID 3224 wrote to memory of 2040	3224	AudioEndpointBuilder.exe	vbc.exe
PID 3224 wrote to memory of 2040	3224	AudioEndpointBuilder.exe	vbc.exe
PID 3224 wrote to memory of 2040	3224	AudioEndpointBuilder.exe	vbc.exe
PID 3224 wrote to memory of 2040	3224	AudioEndpointBuilder.exe	vbc.exe
PID 3224 wrote to memory of 2040	3224	AudioEndpointBuilder.exe	vbc.exe
PID 3224 wrote to memory of 2040	3224	AudioEndpointBuilder.exe	vbc.exe
PID 3224 wrote to memory of 112	3224	AudioEndpointBuilder.exe	BrokerInfrastructure.exe
PID 3224 wrote to memory of 112	3224	AudioEndpointBuilder.exe	BrokerInfrastructure.exe
PID 3224 wrote to memory of 112	3224	AudioEndpointBuilder.exe	BrokerInfrastructure.exe

C:\Users\Admin\AppData\Local\Temp\bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe
"C:\Users\Admin\AppData\Local\Temp\bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4576

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
2⤵
- Drops file in Windows directory
PID:3000

C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
C:\Users\Admin\AppData\Roaming\Microsoft\\AudioEndpointBuilder
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3224

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
- Drops file in Windows directory
PID:2040

C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:112

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\BrokerInfrastructure.exe.log
Filesize
224B

MD5
c19eb8c8e7a40e6b987f9d2ee952996e

SHA1
6fc3049855bc9100643e162511673c6df0f28bfb

SHA256
677e9e30350df17e2bc20fa9f7d730e9f7cc6e870d6520a345f5f7dc5b31f58a

SHA512
860713b4a787c2189ed12a47d4b68b60ac00c7a253cae52dd4eb9276dacafeae3a81906b6d0742c8ecfdfaa255777c445beb7c2a532f3c677a9903237ac97596

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
447KB

MD5
754411f368178a09f54d05158e7e17a3

SHA1
b781c408c69827af768eeca418f564e14eaf5eaf

SHA256
bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651

SHA512
5d2083dbfc24efa11608ba443a8f2468685a11bda1502fed1c2774e737d64813f26723d8c8d16904cfe616746ad167b34c5c50936faf516934b6bcab113f8c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
447KB

MD5
754411f368178a09f54d05158e7e17a3

SHA1
b781c408c69827af768eeca418f564e14eaf5eaf

SHA256
bbd8bfb4294a7764093ab934ecabe1f7147cfc539238c6426779786b6acd0651

SHA512
5d2083dbfc24efa11608ba443a8f2468685a11bda1502fed1c2774e737d64813f26723d8c8d16904cfe616746ad167b34c5c50936faf516934b6bcab113f8c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe
Filesize
12KB

MD5
c2054cedfcb281d110cc4c7d4745cac8

SHA1
62c4ceee116166d960d76de5feba706b5812b7af

SHA256
20b179fd6a6faffbb65bf310e6138fc2706a6dee3618830bbce7d2d549e32b5f

SHA512
65993d5cd049cb753b65f61bef2ba06d91c6faefcec0e105c47208b090b60c5db40206df47387ca087b98f482dba3b8aba81d491722ea925429d902d52a22fbc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe
Filesize
12KB

MD5
c2054cedfcb281d110cc4c7d4745cac8

SHA1
62c4ceee116166d960d76de5feba706b5812b7af

SHA256
20b179fd6a6faffbb65bf310e6138fc2706a6dee3618830bbce7d2d549e32b5f

SHA512
65993d5cd049cb753b65f61bef2ba06d91c6faefcec0e105c47208b090b60c5db40206df47387ca087b98f482dba3b8aba81d491722ea925429d902d52a22fbc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe
Filesize
12KB

MD5
c2054cedfcb281d110cc4c7d4745cac8

SHA1
62c4ceee116166d960d76de5feba706b5812b7af

SHA256
20b179fd6a6faffbb65bf310e6138fc2706a6dee3618830bbce7d2d549e32b5f

SHA512
65993d5cd049cb753b65f61bef2ba06d91c6faefcec0e105c47208b090b60c5db40206df47387ca087b98f482dba3b8aba81d491722ea925429d902d52a22fbc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe
Filesize
12KB

MD5
c2054cedfcb281d110cc4c7d4745cac8

SHA1
62c4ceee116166d960d76de5feba706b5812b7af

SHA256
20b179fd6a6faffbb65bf310e6138fc2706a6dee3618830bbce7d2d549e32b5f

SHA512
65993d5cd049cb753b65f61bef2ba06d91c6faefcec0e105c47208b090b60c5db40206df47387ca087b98f482dba3b8aba81d491722ea925429d902d52a22fbc

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier
Filesize
68B

MD5
56f683e384704cef2c6edcbbc006ff24

SHA1
e73555f2f08ffe17dca34b22ba2a2fdbbf6eb622

SHA256
692ceea6acbc042299f2c50517930a8d6b69f3deddce6ecc19f10c866512a4df

SHA512
abe12b08f4725d81e9833325756ce1c7681e60ecf276d8a465d712cefa30c9f8ecc4df86fc7e6f93c7a72e7a2c60b4493a935ce47394756872f88e4a21a65e89

Download Submit
memory/112-162-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/112-161-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/112-156-0x0000000000000000-mapping.dmp

Download
memory/1864-145-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/1864-149-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/1864-138-0x0000000000000000-mapping.dmp

Download
memory/1864-147-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/2040-151-0x0000000000000000-mapping.dmp

Download
memory/2040-160-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3000-144-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3000-137-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3000-135-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3000-134-0x0000000000000000-mapping.dmp

Download
memory/3224-148-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/3224-141-0x0000000000000000-mapping.dmp

Download
memory/3224-146-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/4576-150-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/4576-132-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/4576-133-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads