netwire | d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6

General

Target

d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe
Size

8KB
MD5

46185d648b66380eb3fa3cdea9146d77
SHA1

1f253b466688771c9f8d2f67b52fa9e39bfc9329
SHA256

d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6
SHA512

656d9ad3a1aef82b6645318f5e7312379349347c143686e407c2191035acfafed1adfd970eb7f6907032ed95e70b206b1d6da42424e648665d7b03f5edf2d42b
SSDEEP

96:/T978DaGTTNuPONQsAYAlcQf1cEXwr0iG0+k/xS7Zr74bFnU:xHGNuaspcEXz0j/klrN

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

212.193.30.230:3363

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Password@2
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3932-147-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/3932-149-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/3932-150-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe

description	pid	process	target process
PID 4400 set thread context of 3932	4400	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exed1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe

pid	process
724	powershell.exe
724	powershell.exe
4400	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe
4400	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4400	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe
Token: SeDebugPrivilege	724	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe

C:\Users\Admin\AppData\Local\Temp\d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe
"C:\Users\Admin\AppData\Local\Temp\d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMQAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:724

C:\Users\Admin\AppData\Local\Temp\d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe
C:\Users\Admin\AppData\Local\Temp\d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe
2⤵
PID:2864

C:\Users\Admin\AppData\Local\Temp\d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe
C:\Users\Admin\AppData\Local\Temp\d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe
2⤵
PID:3932

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/724-144-0x00000000063D0000-0x00000000063EA000-memory.dmp

Filesize
104KB

Download
memory/724-143-0x0000000007730000-0x0000000007DAA000-memory.dmp

Filesize
6.5MB

Download
memory/724-141-0x0000000005860000-0x00000000058C6000-memory.dmp

Filesize
408KB

Download
memory/724-142-0x0000000005ED0000-0x0000000005EEE000-memory.dmp

Filesize
120KB

Download
memory/724-140-0x0000000005700000-0x0000000005766000-memory.dmp

Filesize
408KB

Download
memory/724-137-0x0000000000000000-mapping.dmp

Download
memory/724-138-0x0000000002920000-0x0000000002956000-memory.dmp

Filesize
216KB

Download
memory/724-139-0x00000000050D0000-0x00000000056F8000-memory.dmp

Filesize
6.2MB

Download
memory/2864-145-0x0000000000000000-mapping.dmp

Download
memory/3932-150-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3932-146-0x0000000000000000-mapping.dmp

Download
memory/3932-147-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3932-149-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4400-134-0x00000000051C0000-0x0000000005252000-memory.dmp

Filesize
584KB

Download
memory/4400-135-0x0000000005180000-0x000000000518A000-memory.dmp

Filesize
40KB

Download
memory/4400-132-0x00000000007B0000-0x00000000007B8000-memory.dmp

Filesize
32KB

Download
memory/4400-133-0x00000000056D0000-0x0000000005C74000-memory.dmp

Filesize
5.6MB

Download
memory/4400-136-0x0000000006BA0000-0x0000000006BC2000-memory.dmp

Filesize
136KB

Download

description	pid	process	target process
PID 4400 wrote to memory of 724	4400	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe	powershell.exe
PID 4400 wrote to memory of 724	4400	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe	powershell.exe
PID 4400 wrote to memory of 724	4400	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe	powershell.exe
PID 4400 wrote to memory of 2864	4400	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe
PID 4400 wrote to memory of 2864	4400	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe
PID 4400 wrote to memory of 2864	4400	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe
PID 4400 wrote to memory of 3932	4400	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe
PID 4400 wrote to memory of 3932	4400	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe
PID 4400 wrote to memory of 3932	4400	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe
PID 4400 wrote to memory of 3932	4400	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe
PID 4400 wrote to memory of 3932	4400	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe
PID 4400 wrote to memory of 3932	4400	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe
PID 4400 wrote to memory of 3932	4400	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe
PID 4400 wrote to memory of 3932	4400	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe
PID 4400 wrote to memory of 3932	4400	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe
PID 4400 wrote to memory of 3932	4400	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe
PID 4400 wrote to memory of 3932	4400	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe	d1c250fd723d26b790ca019cad1cb159a6e95c0add5e57094e33252b53f04da6.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads