netwire | 93e9e0b438bfaa0c8c140019adb0f683d7c9cf068b900fe9ce3ee319daa4071a

General

Target

a2a0aa207be61aa7629ec65e93107316.exe
Size

640KB
MD5

a2a0aa207be61aa7629ec65e93107316
SHA1

f3a582a9aff6e53d7746d6a4ee91dfe7f7ccdb76
SHA256

93e9e0b438bfaa0c8c140019adb0f683d7c9cf068b900fe9ce3ee319daa4071a
SHA512

f4e9f4abc485b9fe7fb9ab11302f4c4c40c38ba53cfabb6229f6430adb7201d87d4d763139a7da0be412d8db39f46e196dd52985df4905f2407e3b60caa1a653
SSDEEP

12288:jwciJ0Bke2A0uI+87nj9UsG2P5xFfPtIgQQoz0hR2H9jq:60S5AdIvj91B5xF3aZ54hRE9j

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

podzeye2.duckdns.org:4433

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
lock_executable
false
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2180-144-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/2180-145-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/2180-146-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/2180-147-0x0000000000400000-0x0000000000450000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a2a0aa207be61aa7629ec65e93107316.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	a2a0aa207be61aa7629ec65e93107316.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a2a0aa207be61aa7629ec65e93107316.exe

description pid process target process

PID 4844 set thread context of 2180 4844 a2a0aa207be61aa7629ec65e93107316.exe a2a0aa207be61aa7629ec65e93107316.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1484 schtasks.exe

description	pid	process	target process
PID 4844 set thread context of 2180	4844	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe

pid	process
1484	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

a2a0aa207be61aa7629ec65e93107316.exepowershell.exe

pid	process
4844	a2a0aa207be61aa7629ec65e93107316.exe
4844	a2a0aa207be61aa7629ec65e93107316.exe
4844	a2a0aa207be61aa7629ec65e93107316.exe
4844	a2a0aa207be61aa7629ec65e93107316.exe
4844	a2a0aa207be61aa7629ec65e93107316.exe
4844	a2a0aa207be61aa7629ec65e93107316.exe
4844	a2a0aa207be61aa7629ec65e93107316.exe
4572	powershell.exe
4572	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a2a0aa207be61aa7629ec65e93107316.exepowershell.exe

description pid process

Token: SeDebugPrivilege 4844 a2a0aa207be61aa7629ec65e93107316.exe
Token: SeDebugPrivilege 4572 powershell.exe

description	pid	process
Token: SeDebugPrivilege	4844	a2a0aa207be61aa7629ec65e93107316.exe
Token: SeDebugPrivilege	4572	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

a2a0aa207be61aa7629ec65e93107316.exe

C:\Users\Admin\AppData\Local\Temp\a2a0aa207be61aa7629ec65e93107316.exe
"C:\Users\Admin\AppData\Local\Temp\a2a0aa207be61aa7629ec65e93107316.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4844

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DaYzQRrVVR.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4572

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DaYzQRrVVR" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD4C5.tmp"
2⤵
- Creates scheduled task(s)
PID:1484

C:\Users\Admin\AppData\Local\Temp\a2a0aa207be61aa7629ec65e93107316.exe
"C:\Users\Admin\AppData\Local\Temp\a2a0aa207be61aa7629ec65e93107316.exe"
2⤵
PID:2180

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD4C5.tmp
Filesize
1KB

MD5
94798734d59e386d8fc39da4d9a28bba

SHA1
04f97efcc739d32d5ec8b08585acdfdca2420d29

SHA256
26fb466aeec15b0b64c31df665f4f14ecad771feed94c04fd61db6a9af619858

SHA512
558cd8d38a0cb486bbadeea73a0faad4555256bf66bf7c78ec0495dbdfa1db8beb39e2bb5ad4e6f6c9e97979ede4d457e8df8dd8480137e6896c27a2a3c7ad30

Download Submit
memory/1484-139-0x0000000000000000-mapping.dmp

Download
memory/2180-146-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2180-144-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2180-147-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2180-145-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2180-142-0x0000000000000000-mapping.dmp

Download
memory/4572-159-0x00000000073E0000-0x00000000073EE000-memory.dmp

Filesize
56KB

Download
memory/4572-155-0x00000000077D0000-0x0000000007E4A000-memory.dmp

Filesize
6.5MB

Download
memory/4572-141-0x00000000025A0000-0x00000000025D6000-memory.dmp

Filesize
216KB

Download
memory/4572-143-0x0000000005020000-0x0000000005648000-memory.dmp

Filesize
6.2MB

Download
memory/4572-160-0x00000000074D0000-0x00000000074EA000-memory.dmp

Filesize
104KB

Download
memory/4572-138-0x0000000000000000-mapping.dmp

Download
memory/4572-158-0x0000000007410000-0x00000000074A6000-memory.dmp

Filesize
600KB

Download
memory/4572-161-0x00000000074C0000-0x00000000074C8000-memory.dmp

Filesize
32KB

Download
memory/4572-157-0x0000000007200000-0x000000000720A000-memory.dmp

Filesize
40KB

Download
memory/4572-152-0x0000000006480000-0x00000000064B2000-memory.dmp

Filesize
200KB

Download
memory/4572-149-0x00000000057F0000-0x0000000005856000-memory.dmp

Filesize
408KB

Download
memory/4572-150-0x0000000005860000-0x00000000058C6000-memory.dmp

Filesize
408KB

Download
memory/4572-151-0x0000000005EA0000-0x0000000005EBE000-memory.dmp

Filesize
120KB

Download
memory/4572-148-0x0000000004FD0000-0x0000000004FF2000-memory.dmp

Filesize
136KB

Download
memory/4572-153-0x0000000070EA0000-0x0000000070EEC000-memory.dmp

Filesize
304KB

Download
memory/4572-154-0x0000000006440000-0x000000000645E000-memory.dmp

Filesize
120KB

Download
memory/4572-156-0x0000000007190000-0x00000000071AA000-memory.dmp

Filesize
104KB

Download
memory/4844-133-0x0000000005C60000-0x0000000006204000-memory.dmp

Filesize
5.6MB

Download
memory/4844-135-0x0000000005900000-0x0000000005AA6000-memory.dmp

Filesize
1.6MB

Download
memory/4844-137-0x0000000008250000-0x00000000082EC000-memory.dmp

Filesize
624KB

Download
memory/4844-136-0x0000000005630000-0x000000000563A000-memory.dmp

Filesize
40KB

Download
memory/4844-134-0x00000000056B0000-0x0000000005742000-memory.dmp

Filesize
584KB

Download
memory/4844-132-0x0000000000BE0000-0x0000000000C80000-memory.dmp

Filesize
640KB

Download

description	pid	process	target process
PID 4844 wrote to memory of 4572	4844	a2a0aa207be61aa7629ec65e93107316.exe	powershell.exe
PID 4844 wrote to memory of 4572	4844	a2a0aa207be61aa7629ec65e93107316.exe	powershell.exe
PID 4844 wrote to memory of 4572	4844	a2a0aa207be61aa7629ec65e93107316.exe	powershell.exe
PID 4844 wrote to memory of 1484	4844	a2a0aa207be61aa7629ec65e93107316.exe	schtasks.exe
PID 4844 wrote to memory of 1484	4844	a2a0aa207be61aa7629ec65e93107316.exe	schtasks.exe
PID 4844 wrote to memory of 1484	4844	a2a0aa207be61aa7629ec65e93107316.exe	schtasks.exe
PID 4844 wrote to memory of 2180	4844	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe
PID 4844 wrote to memory of 2180	4844	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe
PID 4844 wrote to memory of 2180	4844	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe
PID 4844 wrote to memory of 2180	4844	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe
PID 4844 wrote to memory of 2180	4844	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe
PID 4844 wrote to memory of 2180	4844	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe
PID 4844 wrote to memory of 2180	4844	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe
PID 4844 wrote to memory of 2180	4844	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe
PID 4844 wrote to memory of 2180	4844	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe
PID 4844 wrote to memory of 2180	4844	a2a0aa207be61aa7629ec65e93107316.exe	a2a0aa207be61aa7629ec65e93107316.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads