netwire | 01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904

General

Target

01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe
Size

157KB
MD5

1b1ee2cddf6295c45045c5c19f64c97c
SHA1

999c3bec2e1c5c2c5f343343f3fdc882d466f2c7
SHA256

01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904
SHA512

e3c5172947ec8405f0d406036b9487695079722d25b1430c2cccbae1e7bb7818f72317e3e02bd967b6c4aad6be67da670e71160ff506b58a08fb0fb376e4548f
SSDEEP

3072:5xUH7LJ8EqJR4c5XEtVPUYMTQknntozSPBqJ/wWix3wq3dinkajFyV26:5xUH/J8FRXLM/wWix3wq3gDjFyV26

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4740-139-0x0000000000400000-0x0000000000417000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

winhst.exewinhst.exe

pid process

1396 winhst.exe
4032 winhst.exe

pid	process
1396	winhst.exe
4032	winhst.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exewinhst.exe

description	pid	process	target process
PID 4820 set thread context of 4740	4820	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe
PID 1396 set thread context of 4032	1396	winhst.exe	winhst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exewinhst.exe

description	pid	process
Token: SeDebugPrivilege	4820	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe
Token: SeDebugPrivilege	1396	winhst.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exewinhst.exe

description	pid	process	target process
PID 4820 wrote to memory of 4740	4820	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe
PID 4820 wrote to memory of 4740	4820	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe
PID 4820 wrote to memory of 4740	4820	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe
PID 4820 wrote to memory of 4740	4820	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe
PID 4820 wrote to memory of 4740	4820	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe
PID 4820 wrote to memory of 4740	4820	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe
PID 4820 wrote to memory of 4740	4820	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe
PID 4820 wrote to memory of 4740	4820	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe
PID 4740 wrote to memory of 1396	4740	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe	winhst.exe
PID 4740 wrote to memory of 1396	4740	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe	winhst.exe
PID 4740 wrote to memory of 1396	4740	01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe	winhst.exe
PID 1396 wrote to memory of 4032	1396	winhst.exe	winhst.exe
PID 1396 wrote to memory of 4032	1396	winhst.exe	winhst.exe
PID 1396 wrote to memory of 4032	1396	winhst.exe	winhst.exe
PID 1396 wrote to memory of 4032	1396	winhst.exe	winhst.exe
PID 1396 wrote to memory of 4032	1396	winhst.exe	winhst.exe
PID 1396 wrote to memory of 4032	1396	winhst.exe	winhst.exe
PID 1396 wrote to memory of 4032	1396	winhst.exe	winhst.exe
PID 1396 wrote to memory of 4032	1396	winhst.exe	winhst.exe

C:\Users\Admin\AppData\Local\Temp\01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe
"C:\Users\Admin\AppData\Local\Temp\01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820

C:\Users\Admin\AppData\Local\Temp\01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe
"C:\Users\Admin\AppData\Local\Temp\01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904.exe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4740

C:\Users\Admin\AppData\Roaming\Install\winhst.exe
"C:\Users\Admin\AppData\Roaming\Install\winhst.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396

C:\Users\Admin\AppData\Roaming\Install\winhst.exe
"C:\Users\Admin\AppData\Roaming\Install\winhst.exe"
4⤵
- Executes dropped EXE
PID:4032

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\winhst.exe
Filesize
157KB

MD5
1b1ee2cddf6295c45045c5c19f64c97c

SHA1
999c3bec2e1c5c2c5f343343f3fdc882d466f2c7

SHA256
01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904

SHA512
e3c5172947ec8405f0d406036b9487695079722d25b1430c2cccbae1e7bb7818f72317e3e02bd967b6c4aad6be67da670e71160ff506b58a08fb0fb376e4548f

Download Submit
C:\Users\Admin\AppData\Roaming\Install\winhst.exe
Filesize
157KB

MD5
1b1ee2cddf6295c45045c5c19f64c97c

SHA1
999c3bec2e1c5c2c5f343343f3fdc882d466f2c7

SHA256
01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904

SHA512
e3c5172947ec8405f0d406036b9487695079722d25b1430c2cccbae1e7bb7818f72317e3e02bd967b6c4aad6be67da670e71160ff506b58a08fb0fb376e4548f

Download Submit
C:\Users\Admin\AppData\Roaming\Install\winhst.exe
Filesize
157KB

MD5
1b1ee2cddf6295c45045c5c19f64c97c

SHA1
999c3bec2e1c5c2c5f343343f3fdc882d466f2c7

SHA256
01f2e272be7404ce5c9d13bb0afe224e9257477bff1be0bbaa8c51f1b270a904

SHA512
e3c5172947ec8405f0d406036b9487695079722d25b1430c2cccbae1e7bb7818f72317e3e02bd967b6c4aad6be67da670e71160ff506b58a08fb0fb376e4548f

Download Submit
memory/1396-149-0x00000000752C0000-0x0000000075871000-memory.dmp

Filesize
5.7MB

Download
memory/1396-144-0x00000000752C0000-0x0000000075871000-memory.dmp

Filesize
5.7MB

Download
memory/1396-143-0x00000000752C0000-0x0000000075871000-memory.dmp

Filesize
5.7MB

Download
memory/1396-140-0x0000000000000000-mapping.dmp

Download
memory/4032-145-0x0000000000000000-mapping.dmp

Download
memory/4740-135-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4740-139-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4740-137-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4740-134-0x0000000000000000-mapping.dmp

Download
memory/4820-138-0x00000000751C0000-0x0000000075771000-memory.dmp

Filesize
5.7MB

Download
memory/4820-132-0x00000000751C0000-0x0000000075771000-memory.dmp

Filesize
5.7MB

Download
memory/4820-133-0x00000000751C0000-0x0000000075771000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads