netwire | 5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8

General

Target

5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe
Size

288KB
MD5

b64e104e4311c786de0455bf83677263
SHA1

7782ea628b522c987be35eaf0a65151304260f3e
SHA256

5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8
SHA512

2bb1cb4ff4127ea1dc4739e7ea8e52049a1659ceb94638d98f87a9804b47f50a403ff5a641549cac7a4a5eea895f1e14d77d2161e37deae16e0e0380e8e29657
SSDEEP

6144:8akMy0hZLDtnu+B1GeKwrF+zX+8PSj8EqLLKfKYEp:88VhZoLe7MzRSI/Kf

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1044-60-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1044-62-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1044-63-0x0000000000402196-mapping.dmp	netwire
behavioral1/memory/1044-66-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1044-68-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1044-70-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 2 IoCs

Processes:

5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe

description	pid	process	target process
PID 1720 set thread context of 1044	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 set thread context of 764	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe

Drops file in Windows directory 2 IoCs

Processes:

RegSvcs.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier	RegSvcs.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe

pid	process
1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe
1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe

description pid process

Token: SeDebugPrivilege 1720 5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe

description	pid	process
Token: SeDebugPrivilege	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe

description	pid	process	target process
PID 1720 wrote to memory of 1044	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 1044	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 1044	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 1044	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 1044	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 1044	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 1044	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 1044	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 1044	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 1044	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 1044	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 1044	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 1372	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 1372	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 1372	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 1372	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 1372	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 1372	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 1372	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 764	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 764	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 764	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 764	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 764	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 764	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 764	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 764	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 764	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 764	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 764	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1720 wrote to memory of 764	1720	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe
"C:\Users\Admin\AppData\Local\Temp\5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
2⤵
- Drops file in Windows directory
PID:1044

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe" /uSILlzCwX /C:\Users\Admin\AppData\Roaming\uSILlzCwX\uSILlzCwX.exe
2⤵
PID:1372

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe" /uSILlzCwX /C:\Users\Admin\AppData\Roaming\uSILlzCwX\uSILlzCwX.exe
2⤵
PID:764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/764-73-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/764-83-0x0000000074990000-0x0000000074F3B000-memory.dmp

Filesize
5.7MB

Download
memory/764-82-0x0000000074990000-0x0000000074F3B000-memory.dmp

Filesize
5.7MB

Download
memory/764-80-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/764-78-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/764-76-0x00000000004026FA-mapping.dmp

Download
memory/764-75-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/764-71-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/764-72-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1044-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1044-70-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1044-68-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1044-66-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1044-63-0x0000000000402196-mapping.dmp

Download
memory/1044-60-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1044-58-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1044-56-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1044-55-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1720-69-0x0000000074990000-0x0000000074F3B000-memory.dmp

Filesize
5.7MB

Download
memory/1720-67-0x0000000074990000-0x0000000074F3B000-memory.dmp

Filesize
5.7MB

Download
memory/1720-54-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download
memory/1720-84-0x0000000074990000-0x0000000074F3B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads