netwire | 93e9e0b438bfaa0c8c140019adb0f683d7c9cf068b900fe9ce3ee319daa4071a

General

Target

a2a0aa207be61aa7629ec65e93107316.exe
Size

640KB
MD5

a2a0aa207be61aa7629ec65e93107316
SHA1

f3a582a9aff6e53d7746d6a4ee91dfe7f7ccdb76
SHA256

93e9e0b438bfaa0c8c140019adb0f683d7c9cf068b900fe9ce3ee319daa4071a
SHA512

f4e9f4abc485b9fe7fb9ab11302f4c4c40c38ba53cfabb6229f6430adb7201d87d4d763139a7da0be412d8db39f46e196dd52985df4905f2407e3b60caa1a653
SSDEEP

12288:jwciJ0Bke2A0uI+87nj9UsG2P5xFfPtIgQQoz0hR2H9jq:60S5AdIvj91B5xF3aZ54hRE9j

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

podzeye2.duckdns.org:4433

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
lock_executable
false
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 7 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1124-69-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1124-71-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1124-72-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1124-74-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1124-75-0x000000000041AE7B-mapping.dmp	netwire
behavioral1/memory/1124-78-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1124-79-0x0000000000400000-0x0000000000450000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

a2a0aa207be61aa7629ec65e93107316.exe

description pid process target process

PID 1208 set thread context of 1124 1208 a2a0aa207be61aa7629ec65e93107316.exe a2a0aa207be61aa7629ec65e93107316.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1868 schtasks.exe

description	pid	process	target process
PID 1208 set thread context of 1124	1208	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe

pid	process
1868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

a2a0aa207be61aa7629ec65e93107316.exepowershell.exe

pid	process
1208	a2a0aa207be61aa7629ec65e93107316.exe
1208	a2a0aa207be61aa7629ec65e93107316.exe
1208	a2a0aa207be61aa7629ec65e93107316.exe
1208	a2a0aa207be61aa7629ec65e93107316.exe
1208	a2a0aa207be61aa7629ec65e93107316.exe
1208	a2a0aa207be61aa7629ec65e93107316.exe
1208	a2a0aa207be61aa7629ec65e93107316.exe
1208	a2a0aa207be61aa7629ec65e93107316.exe
1872	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a2a0aa207be61aa7629ec65e93107316.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1208 a2a0aa207be61aa7629ec65e93107316.exe
Token: SeDebugPrivilege 1872 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1208	a2a0aa207be61aa7629ec65e93107316.exe
Token: SeDebugPrivilege	1872	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

a2a0aa207be61aa7629ec65e93107316.exe

description	pid	process	target process
PID 1208 wrote to memory of 1872	1208	a2a0aa207be61aa7629ec65e93107316.exe	powershell.exe
PID 1208 wrote to memory of 1872	1208	a2a0aa207be61aa7629ec65e93107316.exe	powershell.exe
PID 1208 wrote to memory of 1872	1208	a2a0aa207be61aa7629ec65e93107316.exe	powershell.exe
PID 1208 wrote to memory of 1872	1208	a2a0aa207be61aa7629ec65e93107316.exe	powershell.exe
PID 1208 wrote to memory of 1868	1208	a2a0aa207be61aa7629ec65e93107316.exe	schtasks.exe
PID 1208 wrote to memory of 1868	1208	a2a0aa207be61aa7629ec65e93107316.exe	schtasks.exe
PID 1208 wrote to memory of 1868	1208	a2a0aa207be61aa7629ec65e93107316.exe	schtasks.exe
PID 1208 wrote to memory of 1868	1208	a2a0aa207be61aa7629ec65e93107316.exe	schtasks.exe
PID 1208 wrote to memory of 1124	1208	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe
PID 1208 wrote to memory of 1124	1208	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe
PID 1208 wrote to memory of 1124	1208	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe
PID 1208 wrote to memory of 1124	1208	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe
PID 1208 wrote to memory of 1124	1208	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe
PID 1208 wrote to memory of 1124	1208	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe
PID 1208 wrote to memory of 1124	1208	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe
PID 1208 wrote to memory of 1124	1208	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe
PID 1208 wrote to memory of 1124	1208	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe
PID 1208 wrote to memory of 1124	1208	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe
PID 1208 wrote to memory of 1124	1208	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe

C:\Users\Admin\AppData\Local\Temp\a2a0aa207be61aa7629ec65e93107316.exe
"C:\Users\Admin\AppData\Local\Temp\a2a0aa207be61aa7629ec65e93107316.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DaYzQRrVVR.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1872

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DaYzQRrVVR" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD154.tmp"
2⤵
- Creates scheduled task(s)
PID:1868

C:\Users\Admin\AppData\Local\Temp\a2a0aa207be61aa7629ec65e93107316.exe
"C:\Users\Admin\AppData\Local\Temp\a2a0aa207be61aa7629ec65e93107316.exe"
2⤵
PID:1124

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD154.tmp
Filesize
1KB

MD5
095f0e324c38a0fc74c6427d7b1d70e2

SHA1
cd7156801eddf8bffb9d56344113b49a923f4a36

SHA256
f605122f5345444a388fc9089c90e7c13f50c9a08848bb65b2bc3e0b98d9f6e1

SHA512
53e2f5e3299dcf2d030767fd1509d68e7e6eb745651ef1a07633f91aa5c966493209fb2ec09d0fe8d72b3153a5ab5e66777087e95b3be267ece3c3736ed91802

Download Submit
memory/1124-74-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1124-72-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1124-64-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1124-65-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1124-78-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1124-75-0x000000000041AE7B-mapping.dmp

Download
memory/1124-71-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1124-67-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1124-69-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1124-79-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1208-63-0x0000000001110000-0x000000000115A000-memory.dmp

Filesize
296KB

Download
memory/1208-55-0x00000000759C1000-0x00000000759C3000-memory.dmp

Filesize
8KB

Download
memory/1208-56-0x00000000003D0000-0x00000000003E6000-memory.dmp

Filesize
88KB

Download
memory/1208-54-0x0000000001290000-0x0000000001330000-memory.dmp

Filesize
640KB

Download
memory/1208-58-0x0000000005700000-0x0000000005784000-memory.dmp

Filesize
528KB

Download
memory/1208-57-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1868-61-0x0000000000000000-mapping.dmp

Download
memory/1872-81-0x000000006E340000-0x000000006E8EB000-memory.dmp

Filesize
5.7MB

Download
memory/1872-59-0x0000000000000000-mapping.dmp

Download
memory/1872-80-0x000000006E340000-0x000000006E8EB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads