netwire | e0143cf54d109163f0f807816907b3e375170dd9ce576164a519efba66983459

General

Target

e0143cf54d109163f0f807816907b3e375170dd9ce576164a519efba66983459_timedlll.exe
Size

484KB
MD5

8f18d06bd4d22a313565373d9e638ebc
SHA1

9e83aa2284e2c2094d649b909d50b885c4193fe5
SHA256

e0143cf54d109163f0f807816907b3e375170dd9ce576164a519efba66983459
SHA512

efd124190ccef60f2826e0a608dbc5d2c5f9d75a57c0eb2dec874592e6bc8f5a38155e6b81590c038a6a1009fa93e410daa5cb01f15a1f2ee4340ab98a9702c8
SSDEEP

6144:ql41F6zaFhj4pgKTmUK5vN5vdKrV1T8xt2+ilHsPerH6inevq4Wl:ql46Qhj4prSpVRduVJ8++9mrLevzWl

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

185.145.45.41:3368

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
fuwqWcrJ
offline_keylogger
true
password
Gentle123
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2084-147-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

kinglike.exe

pid process

2084 kinglike.exe

pid	process
2084	kinglike.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e0143cf54d109163f0f807816907b3e375170dd9ce576164a519efba66983459_timedlll.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	e0143cf54d109163f0f807816907b3e375170dd9ce576164a519efba66983459_timedlll.exe

Drops file in Windows directory 2 IoCs

Processes:

e0143cf54d109163f0f807816907b3e375170dd9ce576164a519efba66983459_timedlll.exekinglike.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	e0143cf54d109163f0f807816907b3e375170dd9ce576164a519efba66983459_timedlll.exe
File opened for modification	C:\Windows\win.ini	kinglike.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1568 schtasks.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e0143cf54d109163f0f807816907b3e375170dd9ce576164a519efba66983459_timedlll.exekinglike.exe

pid process

2472 e0143cf54d109163f0f807816907b3e375170dd9ce576164a519efba66983459_timedlll.exe
2084 kinglike.exe

pid	process
1568	schtasks.exe

pid	process
2472	e0143cf54d109163f0f807816907b3e375170dd9ce576164a519efba66983459_timedlll.exe
2084	kinglike.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e0143cf54d109163f0f807816907b3e375170dd9ce576164a519efba66983459_timedlll.exe

description	pid	process	target process
PID 2472 wrote to memory of 1568	2472	e0143cf54d109163f0f807816907b3e375170dd9ce576164a519efba66983459_timedlll.exe	schtasks.exe
PID 2472 wrote to memory of 1568	2472	e0143cf54d109163f0f807816907b3e375170dd9ce576164a519efba66983459_timedlll.exe	schtasks.exe
PID 2472 wrote to memory of 1568	2472	e0143cf54d109163f0f807816907b3e375170dd9ce576164a519efba66983459_timedlll.exe	schtasks.exe
PID 2472 wrote to memory of 648	2472	e0143cf54d109163f0f807816907b3e375170dd9ce576164a519efba66983459_timedlll.exe	schtasks.exe
PID 2472 wrote to memory of 648	2472	e0143cf54d109163f0f807816907b3e375170dd9ce576164a519efba66983459_timedlll.exe	schtasks.exe
PID 2472 wrote to memory of 648	2472	e0143cf54d109163f0f807816907b3e375170dd9ce576164a519efba66983459_timedlll.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\e0143cf54d109163f0f807816907b3e375170dd9ce576164a519efba66983459_timedlll.exe
"C:\Users\Admin\AppData\Local\Temp\e0143cf54d109163f0f807816907b3e375170dd9ce576164a519efba66983459_timedlll.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN "Belgningsstuens" /TR "C:\Users\Admin\AppData\Roaming\kinglike.exe"
2⤵
- Creates scheduled task(s)
PID:1568

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /run /tn "Belgningsstuens"
2⤵
PID:648

C:\Users\Admin\AppData\Roaming\kinglike.exe
C:\Users\Admin\AppData\Roaming\kinglike.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2084

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\kinglike.exe
Filesize
484KB

MD5
ea40ee2956af9027022020b83c67eaeb

SHA1
0e5f3811b06f6d6a6147d06f0eeec4fb1d1afcc1

SHA256
eb62ceaf85055120714d9b82b8da39e7d08a95ebb1763b03009511532c40c7d3

SHA512
8c0cc4840ae0b32dfa71ac9dbdb175fe8ec541636e1470ff324cc26265c5aef8ac1e796f0d505d8e37dff0efea7913a0072a2ebdb205ec3aed92bba40ba0d25e

Download Submit
C:\Users\Admin\AppData\Roaming\kinglike.exe
Filesize
484KB

MD5
ea40ee2956af9027022020b83c67eaeb

SHA1
0e5f3811b06f6d6a6147d06f0eeec4fb1d1afcc1

SHA256
eb62ceaf85055120714d9b82b8da39e7d08a95ebb1763b03009511532c40c7d3

SHA512
8c0cc4840ae0b32dfa71ac9dbdb175fe8ec541636e1470ff324cc26265c5aef8ac1e796f0d505d8e37dff0efea7913a0072a2ebdb205ec3aed92bba40ba0d25e

Download Submit
C:\Windows\win.ini
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/648-138-0x0000000000000000-mapping.dmp

Download
memory/1568-136-0x0000000000000000-mapping.dmp

Download
memory/2084-145-0x0000000003020000-0x0000000003120000-memory.dmp

Filesize
1024KB

Download
memory/2084-147-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2084-153-0x0000000077740000-0x00000000778E3000-memory.dmp

Filesize
1.6MB

Download
memory/2084-154-0x0000000075400000-0x000000007555D000-memory.dmp

Filesize
1.4MB

Download
memory/2084-155-0x0000000003020000-0x0000000003120000-memory.dmp

Filesize
1024KB

Download
memory/2472-139-0x0000000077740000-0x00000000778E3000-memory.dmp

Filesize
1.6MB

Download
memory/2472-137-0x00000000031E0000-0x00000000032E0000-memory.dmp

Filesize
1024KB

Download
memory/2472-135-0x0000000077740000-0x00000000778E3000-memory.dmp

Filesize
1.6MB

Download
memory/2472-134-0x00000000031E0000-0x00000000032E0000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads