netwire | 63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0

General

Target

63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
Size

189KB
MD5

31040235dc0438cef3c784d48a898cfb
SHA1

4dc4a414dcb19e82dd2d89dde626e02e42553933
SHA256

63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0
SHA512

4ae2a495a958ebfdf950919659305d5f703131961d0bb06beb01599b7a59e2fe01107291c2a2bf343d0c046c5ba5a8ab4c3b21aabd5ebff4ff1411b8e3eeba4f
SSDEEP

3072:DuoFPHAkER5odYLyof0hiMWiDdN4dv9ZsA8zQS6666660:XvNEFlMtAcA8i

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4440-136-0x0000000000400000-0x0000000000417000-memory.dmp	netwire
behavioral2/memory/2148-145-0x0000000000400000-0x0000000000417000-memory.dmp	netwire
behavioral2/memory/2148-146-0x0000000000400000-0x0000000000417000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

Host.exeHost.exe

pid process

4892 Host.exe
2148 Host.exe

pid	process
4892	Host.exe
2148	Host.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{QJQ8KS21-G70T-U444-DEIE-871BIJ57MA26}	Host.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{QJQ8KS21-G70T-U444-DEIE-871BIJ57MA26}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\""	Host.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe"	Host.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Host.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exeHost.exe

description	pid	process	target process
PID 3576 set thread context of 4440	3576	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
PID 4892 set thread context of 2148	4892	Host.exe	Host.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exeHost.exe

description	pid	process	target process
PID 3576 wrote to memory of 4440	3576	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
PID 3576 wrote to memory of 4440	3576	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
PID 3576 wrote to memory of 4440	3576	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
PID 3576 wrote to memory of 4440	3576	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
PID 3576 wrote to memory of 4440	3576	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
PID 3576 wrote to memory of 4440	3576	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
PID 3576 wrote to memory of 4440	3576	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
PID 3576 wrote to memory of 4440	3576	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
PID 4440 wrote to memory of 4892	4440	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	Host.exe
PID 4440 wrote to memory of 4892	4440	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	Host.exe
PID 4440 wrote to memory of 4892	4440	63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe	Host.exe
PID 4892 wrote to memory of 2148	4892	Host.exe	Host.exe
PID 4892 wrote to memory of 2148	4892	Host.exe	Host.exe
PID 4892 wrote to memory of 2148	4892	Host.exe	Host.exe
PID 4892 wrote to memory of 2148	4892	Host.exe	Host.exe
PID 4892 wrote to memory of 2148	4892	Host.exe	Host.exe
PID 4892 wrote to memory of 2148	4892	Host.exe	Host.exe
PID 4892 wrote to memory of 2148	4892	Host.exe	Host.exe
PID 4892 wrote to memory of 2148	4892	Host.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
"C:\Users\Admin\AppData\Local\Temp\63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3576

C:\Users\Admin\AppData\Local\Temp\63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe
"C:\Users\Admin\AppData\Local\Temp\63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0.exe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4440

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4892

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:2148

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
189KB

MD5
31040235dc0438cef3c784d48a898cfb

SHA1
4dc4a414dcb19e82dd2d89dde626e02e42553933

SHA256
63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0

SHA512
4ae2a495a958ebfdf950919659305d5f703131961d0bb06beb01599b7a59e2fe01107291c2a2bf343d0c046c5ba5a8ab4c3b21aabd5ebff4ff1411b8e3eeba4f

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
189KB

MD5
31040235dc0438cef3c784d48a898cfb

SHA1
4dc4a414dcb19e82dd2d89dde626e02e42553933

SHA256
63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0

SHA512
4ae2a495a958ebfdf950919659305d5f703131961d0bb06beb01599b7a59e2fe01107291c2a2bf343d0c046c5ba5a8ab4c3b21aabd5ebff4ff1411b8e3eeba4f

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
189KB

MD5
31040235dc0438cef3c784d48a898cfb

SHA1
4dc4a414dcb19e82dd2d89dde626e02e42553933

SHA256
63d1fc92e09e8534cb2ee7d788ce2ee3bad69af64ef7386562569359167605d0

SHA512
4ae2a495a958ebfdf950919659305d5f703131961d0bb06beb01599b7a59e2fe01107291c2a2bf343d0c046c5ba5a8ab4c3b21aabd5ebff4ff1411b8e3eeba4f

Download Submit
memory/2148-140-0x0000000000000000-mapping.dmp

Download
memory/2148-145-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2148-146-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4440-132-0x0000000000000000-mapping.dmp

Download
memory/4440-133-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4440-135-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4440-136-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4892-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads