netwire | d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe

General

Target

d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe
Size

2.4MB
MD5

dc794c6baef5fa590421ac67e3d08a4b
SHA1

3362ee2afdb1cf40830a8e3e3ec2dde1eb0887a0
SHA256

d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe
SHA512

08133ba467a25450a303323ddc21ac0697a75bf42ee80994dcc89161c1d7b03e3a9960c782d2126522076c115404492cf7490e5cbe979e1c2ba8baa895227cf6
SSDEEP

49152:2JGhVJmzCDq35LO3mIp07KtjgRk0oqRuwSCFVPB9ZhhqDF8xLt9QQfBcWqeR+jl2:2gjLW8OjQ1a7

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

venezia-pl.myq-see.com:3737

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
February-2021
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
bQkxKHhm
offline_keylogger
true
password
ALANKA121
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3420-139-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/3420-141-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/3420-143-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Drops startup file 2 IoCs

Processes:

Powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe

description	pid	process	target process
PID 1892 set thread context of 3420	1892	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Powershell.exe

pid process

2880 Powershell.exe
2880 Powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 2880 Powershell.exe

pid	process
2880	Powershell.exe
2880	Powershell.exe

description	pid	process
Token: SeDebugPrivilege	2880	Powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe

description	pid	process	target process
PID 1892 wrote to memory of 2880	1892	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe	Powershell.exe
PID 1892 wrote to memory of 2880	1892	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe	Powershell.exe
PID 1892 wrote to memory of 2880	1892	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe	Powershell.exe
PID 1892 wrote to memory of 3420	1892	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe
PID 1892 wrote to memory of 3420	1892	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe
PID 1892 wrote to memory of 3420	1892	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe
PID 1892 wrote to memory of 3420	1892	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe
PID 1892 wrote to memory of 3420	1892	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe
PID 1892 wrote to memory of 3420	1892	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe
PID 1892 wrote to memory of 3420	1892	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe
PID 1892 wrote to memory of 3420	1892	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe
PID 1892 wrote to memory of 3420	1892	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe
PID 1892 wrote to memory of 3420	1892	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe
PID 1892 wrote to memory of 3420	1892	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe	d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe

C:\Users\Admin\AppData\Local\Temp\d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe
"C:\Users\Admin\AppData\Local\Temp\d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe'
2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880

C:\Users\Admin\AppData\Local\Temp\d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe
"C:\Users\Admin\AppData\Local\Temp\d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe.exe"
2⤵
PID:3420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1892-132-0x00000000008B0000-0x0000000000B24000-memory.dmp

Filesize
2.5MB

Download
memory/1892-133-0x0000000005B60000-0x0000000006104000-memory.dmp

Filesize
5.6MB

Download
memory/1892-134-0x00000000054D0000-0x0000000005562000-memory.dmp

Filesize
584KB

Download
memory/1892-135-0x0000000005A30000-0x0000000005ACC000-memory.dmp

Filesize
624KB

Download
memory/2880-145-0x00000000054E0000-0x0000000005546000-memory.dmp

Filesize
408KB

Download
memory/2880-147-0x0000000005B00000-0x0000000005B1E000-memory.dmp

Filesize
120KB

Download
memory/2880-137-0x0000000004520000-0x0000000004556000-memory.dmp

Filesize
216KB

Download
memory/2880-150-0x0000000006070000-0x0000000006092000-memory.dmp

Filesize
136KB

Download
memory/2880-149-0x0000000005FF0000-0x000000000600A000-memory.dmp

Filesize
104KB

Download
memory/2880-142-0x0000000004CC0000-0x00000000052E8000-memory.dmp

Filesize
6.2MB

Download
memory/2880-148-0x00000000060E0000-0x0000000006176000-memory.dmp

Filesize
600KB

Download
memory/2880-144-0x0000000004BB0000-0x0000000004BD2000-memory.dmp

Filesize
136KB

Download
memory/2880-136-0x0000000000000000-mapping.dmp

Download
memory/2880-146-0x0000000005550000-0x00000000055B6000-memory.dmp

Filesize
408KB

Download
memory/3420-138-0x0000000000000000-mapping.dmp

Download
memory/3420-143-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3420-141-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3420-139-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads