netwire | 63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0

General

Target

63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
Size

189KB
MD5

31040235dc0438cef3c784d48a898cfb
SHA1

4dc4a414dcb19e82dd2d89dde626e02e42553933
SHA256

63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0
SHA512

4ae2a495a958ebfdf950919659305d5f703131961d0bb06beb01599b7a59e2fe01107291c2a2bf343d0c046c5ba5a8ab4c3b21aabd5ebff4ff1411b8e3eeba4f
SSDEEP

3072:DuoFPHAkER5odYLyof0hiMWiDdN4dv9ZsA8zQS6666660:XvNEFlMtAcA8i

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1068-66-0x0000000000400000-0x0000000000417000-memory.dmp	netwire
behavioral1/memory/1296-85-0x0000000000400000-0x0000000000417000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

Host.exeHost.exe

pid process

1152 Host.exe
1296 Host.exe

pid	process
1152	Host.exe
1296	Host.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{QJQ8KS21-G70T-U444-DEIE-871BIJ57MA26}	Host.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{QJQ8KS21-G70T-U444-DEIE-871BIJ57MA26}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\""	Host.exe

Loads dropped DLL 2 IoCs

Processes:

63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe

pid	process
1068	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
1068	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe"	Host.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exeHost.exe

description	pid	process	target process
PID 1492 set thread context of 1068	1492	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
PID 1152 set thread context of 1296	1152	Host.exe	Host.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exeHost.exe

description	pid	process	target process
PID 1492 wrote to memory of 1068	1492	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
PID 1492 wrote to memory of 1068	1492	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
PID 1492 wrote to memory of 1068	1492	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
PID 1492 wrote to memory of 1068	1492	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
PID 1492 wrote to memory of 1068	1492	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
PID 1492 wrote to memory of 1068	1492	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
PID 1492 wrote to memory of 1068	1492	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
PID 1492 wrote to memory of 1068	1492	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
PID 1068 wrote to memory of 1152	1068	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	Host.exe
PID 1068 wrote to memory of 1152	1068	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	Host.exe
PID 1068 wrote to memory of 1152	1068	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	Host.exe
PID 1068 wrote to memory of 1152	1068	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	Host.exe
PID 1152 wrote to memory of 1296	1152	Host.exe	Host.exe
PID 1152 wrote to memory of 1296	1152	Host.exe	Host.exe
PID 1152 wrote to memory of 1296	1152	Host.exe	Host.exe
PID 1152 wrote to memory of 1296	1152	Host.exe	Host.exe
PID 1152 wrote to memory of 1296	1152	Host.exe	Host.exe
PID 1152 wrote to memory of 1296	1152	Host.exe	Host.exe
PID 1152 wrote to memory of 1296	1152	Host.exe	Host.exe
PID 1152 wrote to memory of 1296	1152	Host.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
"C:\Users\Admin\AppData\Local\Temp\63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1492

C:\Users\Admin\AppData\Local\Temp\63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
"C:\Users\Admin\AppData\Local\Temp\63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1068

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1152

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:1296

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
189KB

MD5
31040235dc0438cef3c784d48a898cfb

SHA1
4dc4a414dcb19e82dd2d89dde626e02e42553933

SHA256
63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0

SHA512
4ae2a495a958ebfdf950919659305d5f703131961d0bb06beb01599b7a59e2fe01107291c2a2bf343d0c046c5ba5a8ab4c3b21aabd5ebff4ff1411b8e3eeba4f

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
189KB

MD5
31040235dc0438cef3c784d48a898cfb

SHA1
4dc4a414dcb19e82dd2d89dde626e02e42553933

SHA256
63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0

SHA512
4ae2a495a958ebfdf950919659305d5f703131961d0bb06beb01599b7a59e2fe01107291c2a2bf343d0c046c5ba5a8ab4c3b21aabd5ebff4ff1411b8e3eeba4f

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
189KB

MD5
31040235dc0438cef3c784d48a898cfb

SHA1
4dc4a414dcb19e82dd2d89dde626e02e42553933

SHA256
63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0

SHA512
4ae2a495a958ebfdf950919659305d5f703131961d0bb06beb01599b7a59e2fe01107291c2a2bf343d0c046c5ba5a8ab4c3b21aabd5ebff4ff1411b8e3eeba4f

Download Submit
\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
189KB

MD5
31040235dc0438cef3c784d48a898cfb

SHA1
4dc4a414dcb19e82dd2d89dde626e02e42553933

SHA256
63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0

SHA512
4ae2a495a958ebfdf950919659305d5f703131961d0bb06beb01599b7a59e2fe01107291c2a2bf343d0c046c5ba5a8ab4c3b21aabd5ebff4ff1411b8e3eeba4f

Download Submit
\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
189KB

MD5
31040235dc0438cef3c784d48a898cfb

SHA1
4dc4a414dcb19e82dd2d89dde626e02e42553933

SHA256
63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0

SHA512
4ae2a495a958ebfdf950919659305d5f703131961d0bb06beb01599b7a59e2fe01107291c2a2bf343d0c046c5ba5a8ab4c3b21aabd5ebff4ff1411b8e3eeba4f

Download Submit
memory/1068-61-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1068-64-0x0000000075491000-0x0000000075493000-memory.dmp

Filesize
8KB

Download
memory/1068-65-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1068-66-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1068-62-0x0000000000401D82-mapping.dmp

Download
memory/1068-54-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1068-59-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1068-57-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1068-55-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1152-69-0x0000000000000000-mapping.dmp

Download
memory/1296-80-0x0000000000401D82-mapping.dmp

Download
memory/1296-85-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads