netwire | 5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8

General

Target

5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe
Size

288KB
MD5

b64e104e4311c786de0455bf83677263
SHA1

7782ea628b522c987be35eaf0a65151304260f3e
SHA256

5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8
SHA512

2bb1cb4ff4127ea1dc4739e7ea8e52049a1659ceb94638d98f87a9804b47f50a403ff5a641549cac7a4a5eea895f1e14d77d2161e37deae16e0e0380e8e29657
SSDEEP

6144:8akMy0hZLDtnu+B1GeKwrF+zX+8PSj8EqLLKfKYEp:88VhZoLe7MzRSI/Kf

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/240-135-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/240-137-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/240-138-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uSILlzCwX = "\"C:\\Users\\Admin\\AppData\\Roaming\\uSILlzCwX\\uSILlzCwX.exe\""	RegSvcs.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe

description	pid	process	target process
PID 1452 set thread context of 240	1452	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1452 set thread context of 3916	1452	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe

Drops file in Windows directory 2 IoCs

Processes:

RegSvcs.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier	RegSvcs.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe

description	pid	process	target process
PID 1452 wrote to memory of 240	1452	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1452 wrote to memory of 240	1452	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1452 wrote to memory of 240	1452	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1452 wrote to memory of 240	1452	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1452 wrote to memory of 240	1452	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1452 wrote to memory of 240	1452	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1452 wrote to memory of 240	1452	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1452 wrote to memory of 240	1452	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1452 wrote to memory of 3916	1452	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1452 wrote to memory of 3916	1452	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1452 wrote to memory of 3916	1452	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1452 wrote to memory of 3916	1452	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1452 wrote to memory of 3916	1452	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1452 wrote to memory of 3916	1452	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1452 wrote to memory of 3916	1452	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe
PID 1452 wrote to memory of 3916	1452	5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe
"C:\Users\Admin\AppData\Local\Temp\5b30c4dafd1eec3dda306ba50cbe3eea2776d1851417602f51c94308ca0c06d8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
2⤵
- Drops file in Windows directory
PID:240

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe" /uSILlzCwX /C:\Users\Admin\AppData\Roaming\uSILlzCwX\uSILlzCwX.exe
2⤵
- Adds Run key to start application
PID:3916

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/240-134-0x0000000000000000-mapping.dmp

Download
memory/240-135-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/240-137-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/240-138-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1452-132-0x0000000075100000-0x00000000756B1000-memory.dmp

Filesize
5.7MB

Download
memory/1452-133-0x0000000075100000-0x00000000756B1000-memory.dmp

Filesize
5.7MB

Download
memory/1452-144-0x0000000075100000-0x00000000756B1000-memory.dmp

Filesize
5.7MB

Download
memory/3916-139-0x0000000000000000-mapping.dmp

Download
memory/3916-140-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3916-141-0x0000000075100000-0x00000000756B1000-memory.dmp

Filesize
5.7MB

Download
memory/3916-142-0x0000000075100000-0x00000000756B1000-memory.dmp

Filesize
5.7MB

Download
memory/3916-143-0x0000000075100000-0x00000000756B1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads