netwire | ed8a1d7a009815e9d7d1e4eb4064bb842bf22fccd57f47feee4dd1cc9798c9fd

General

Target

ed8a1d7a009815e9d7d1e4eb4064bb842bf22fccd57f47feee4dd1cc9798c9fd.exe
Size

476KB
MD5

79aa2b8dacf7b786c5d1c84ad5bd7b83
SHA1

cbabb849547a604f3d97f4881f7e735c683084bd
SHA256

ed8a1d7a009815e9d7d1e4eb4064bb842bf22fccd57f47feee4dd1cc9798c9fd
SHA512

c5817c47cc0acca676ce06a63a3519f21c3c91f5753da7700745b6cd96a8115b7bd8ea34689b3a8f7125c1fdce1ad91e22f534fb6347e700389daa901291ae5e
SSDEEP

3072:wkkIMPKsWiHtHnTi0LwolBYce3pDsQKtSWY3HGyfJEeA7IpgMNK02ewbudNWU/U:fD3sWiY0koA9sBSWcdf6eidYt

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

extensions14718.sytes.net:3324

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
lock_executable
false
mutex
pjtcCJSh
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3716-142-0x0000000000000000-mapping.dmp	netwire
behavioral2/memory/3716-143-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral2/memory/3716-146-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral2/memory/3716-147-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral2/memory/3716-148-0x0000000000400000-0x0000000000420000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

firefoxpro.exefirefoxpro.exe

pid process

4132 firefoxpro.exe
3716 firefoxpro.exe

pid	process
4132	firefoxpro.exe
3716	firefoxpro.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ed8a1d7a009815e9d7d1e4eb4064bb842bf22fccd57f47feee4dd1cc9798c9fd.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	ed8a1d7a009815e9d7d1e4eb4064bb842bf22fccd57f47feee4dd1cc9798c9fd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WScript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\firefox = "C:\\Users\\Admin\\AppData\\Local\\Temp\\subfolder\\firefoxpro.vbs"	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

firefoxpro.exe

description pid process target process

PID 4132 set thread context of 3716 4132 firefoxpro.exe firefoxpro.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 4132 set thread context of 3716	4132	firefoxpro.exe	firefoxpro.exe

Modifies registry class 1 IoCs

Processes:

ed8a1d7a009815e9d7d1e4eb4064bb842bf22fccd57f47feee4dd1cc9798c9fd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	ed8a1d7a009815e9d7d1e4eb4064bb842bf22fccd57f47feee4dd1cc9798c9fd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ed8a1d7a009815e9d7d1e4eb4064bb842bf22fccd57f47feee4dd1cc9798c9fd.exefirefoxpro.exe

pid process

4496 ed8a1d7a009815e9d7d1e4eb4064bb842bf22fccd57f47feee4dd1cc9798c9fd.exe
4132 firefoxpro.exe

pid	process
4496	ed8a1d7a009815e9d7d1e4eb4064bb842bf22fccd57f47feee4dd1cc9798c9fd.exe
4132	firefoxpro.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

ed8a1d7a009815e9d7d1e4eb4064bb842bf22fccd57f47feee4dd1cc9798c9fd.exeWScript.exefirefoxpro.exe

description	pid	process	target process
PID 4496 wrote to memory of 2400	4496	ed8a1d7a009815e9d7d1e4eb4064bb842bf22fccd57f47feee4dd1cc9798c9fd.exe	WScript.exe
PID 4496 wrote to memory of 2400	4496	ed8a1d7a009815e9d7d1e4eb4064bb842bf22fccd57f47feee4dd1cc9798c9fd.exe	WScript.exe
PID 4496 wrote to memory of 2400	4496	ed8a1d7a009815e9d7d1e4eb4064bb842bf22fccd57f47feee4dd1cc9798c9fd.exe	WScript.exe
PID 2400 wrote to memory of 4132	2400	WScript.exe	firefoxpro.exe
PID 2400 wrote to memory of 4132	2400	WScript.exe	firefoxpro.exe
PID 2400 wrote to memory of 4132	2400	WScript.exe	firefoxpro.exe
PID 4132 wrote to memory of 3716	4132	firefoxpro.exe	firefoxpro.exe
PID 4132 wrote to memory of 3716	4132	firefoxpro.exe	firefoxpro.exe
PID 4132 wrote to memory of 3716	4132	firefoxpro.exe	firefoxpro.exe
PID 4132 wrote to memory of 3716	4132	firefoxpro.exe	firefoxpro.exe
PID 4132 wrote to memory of 3716	4132	firefoxpro.exe	firefoxpro.exe
PID 4132 wrote to memory of 3716	4132	firefoxpro.exe	firefoxpro.exe
PID 4132 wrote to memory of 3716	4132	firefoxpro.exe	firefoxpro.exe
PID 4132 wrote to memory of 3716	4132	firefoxpro.exe	firefoxpro.exe
PID 4132 wrote to memory of 3716	4132	firefoxpro.exe	firefoxpro.exe
PID 4132 wrote to memory of 3716	4132	firefoxpro.exe	firefoxpro.exe

C:\Users\Admin\AppData\Local\Temp\ed8a1d7a009815e9d7d1e4eb4064bb842bf22fccd57f47feee4dd1cc9798c9fd.exe
"C:\Users\Admin\AppData\Local\Temp\ed8a1d7a009815e9d7d1e4eb4064bb842bf22fccd57f47feee4dd1cc9798c9fd.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\subfolder\firefoxpro.vbs"
2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2400

C:\Users\Admin\AppData\Local\Temp\subfolder\firefoxpro.exe
"C:\Users\Admin\AppData\Local\Temp\subfolder\firefoxpro.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132

C:\Users\Admin\AppData\Local\Temp\subfolder\firefoxpro.exe
"C:\Users\Admin\AppData\Local\Temp\subfolder\firefoxpro.exe"
4⤵
- Executes dropped EXE
PID:3716

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\subfolder\firefoxpro.exe
Filesize
476KB

MD5
6167b7295d9bad6d37176e96382b9e86

SHA1
a77e85e3885a51ce43a3844ce9811282d288a7b2

SHA256
4598724a5016b215d2fa970976783e866b925cb49aad2f018b75f8e652e57d3a

SHA512
2df31d3bd4e9a3433c22254f60c43c1c86f705608676a8ec219a930a7cdba82fc1d0db5853997d39af30cea49ed785718415f921c60e4dc6c95c926b656afc76

Download Submit
C:\Users\Admin\AppData\Local\Temp\subfolder\firefoxpro.exe
Filesize
476KB

MD5
6167b7295d9bad6d37176e96382b9e86

SHA1
a77e85e3885a51ce43a3844ce9811282d288a7b2

SHA256
4598724a5016b215d2fa970976783e866b925cb49aad2f018b75f8e652e57d3a

SHA512
2df31d3bd4e9a3433c22254f60c43c1c86f705608676a8ec219a930a7cdba82fc1d0db5853997d39af30cea49ed785718415f921c60e4dc6c95c926b656afc76

Download Submit
C:\Users\Admin\AppData\Local\Temp\subfolder\firefoxpro.exe
Filesize
476KB

MD5
6167b7295d9bad6d37176e96382b9e86

SHA1
a77e85e3885a51ce43a3844ce9811282d288a7b2

SHA256
4598724a5016b215d2fa970976783e866b925cb49aad2f018b75f8e652e57d3a

SHA512
2df31d3bd4e9a3433c22254f60c43c1c86f705608676a8ec219a930a7cdba82fc1d0db5853997d39af30cea49ed785718415f921c60e4dc6c95c926b656afc76

Download Submit
C:\Users\Admin\AppData\Local\Temp\subfolder\firefoxpro.vbs
Filesize
1024B

MD5
5633ea06d76d044e23ff5ed058b09cac

SHA1
a5f8798527ceb451ac6db8fa16649359d34ab896

SHA256
41e8e3ab92c8a25c6c3442cb6dc4eeaffa243573b81c0cf742312465ed20ce9f

SHA512
ddb54c48df72c7c80cb2f14c5b59a9de26dcfe3acef468e706eccd59e20962977d4c3957a456d07fdaea182fffdccd5f34feb5dc64a3e7cf02f2549df6835595

Download Submit
memory/2400-135-0x0000000000000000-mapping.dmp

Download
memory/3716-142-0x0000000000000000-mapping.dmp

Download
memory/3716-143-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3716-146-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3716-147-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3716-148-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4132-138-0x0000000000000000-mapping.dmp

Download
memory/4496-134-0x0000000002370000-0x0000000002377000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads