netwire | 7a0c3008b65ed5033cc3663e9104ed7b39707c2a073ef3626549e0acd64f15f2

General

Target

PO_6733.exe
Size

719KB
MD5

76218662ffd8397441fadb34d12de1cc
SHA1

6432944d6cb7e5acc434d8d7a017c2ae6c21b426
SHA256

7a0c3008b65ed5033cc3663e9104ed7b39707c2a073ef3626549e0acd64f15f2
SHA512

3797d6d25f877f2cfcfa57b4a6ba1a3087f557314b684f78d8c72f53acdde71df7653c99603f3e683b8a2ad8d0a5c8615d9eaa165358d5bb19212d2007ad8d17
SSDEEP

12288:Frp6gxML2DQ8iFoFEyK0xlDxjIWD7+j3c1z3tTm9OrncN6lcQBb:FrfxMXSCp0r6WmjM1z39AAn

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

212.193.30.230:3363

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Password@2
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1784-69-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1784-70-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1784-71-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1784-73-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1784-75-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1784-74-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1784-78-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1784-79-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

PO_6733.exe

description pid process target process

PID 1632 set thread context of 1784 1632 PO_6733.exe PO_6733.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1392 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

772 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 772 powershell.exe

description	pid	process	target process
PID 1632 set thread context of 1784	1632	PO_6733.exe	PO_6733.exe

pid	process
1392	schtasks.exe

pid	process
772	powershell.exe

description	pid	process
Token: SeDebugPrivilege	772	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

PO_6733.exe

description	pid	process	target process
PID 1632 wrote to memory of 772	1632	PO_6733.exe	powershell.exe
PID 1632 wrote to memory of 772	1632	PO_6733.exe	powershell.exe
PID 1632 wrote to memory of 772	1632	PO_6733.exe	powershell.exe
PID 1632 wrote to memory of 772	1632	PO_6733.exe	powershell.exe
PID 1632 wrote to memory of 1392	1632	PO_6733.exe	schtasks.exe
PID 1632 wrote to memory of 1392	1632	PO_6733.exe	schtasks.exe
PID 1632 wrote to memory of 1392	1632	PO_6733.exe	schtasks.exe
PID 1632 wrote to memory of 1392	1632	PO_6733.exe	schtasks.exe
PID 1632 wrote to memory of 1784	1632	PO_6733.exe	PO_6733.exe
PID 1632 wrote to memory of 1784	1632	PO_6733.exe	PO_6733.exe
PID 1632 wrote to memory of 1784	1632	PO_6733.exe	PO_6733.exe
PID 1632 wrote to memory of 1784	1632	PO_6733.exe	PO_6733.exe
PID 1632 wrote to memory of 1784	1632	PO_6733.exe	PO_6733.exe
PID 1632 wrote to memory of 1784	1632	PO_6733.exe	PO_6733.exe
PID 1632 wrote to memory of 1784	1632	PO_6733.exe	PO_6733.exe
PID 1632 wrote to memory of 1784	1632	PO_6733.exe	PO_6733.exe
PID 1632 wrote to memory of 1784	1632	PO_6733.exe	PO_6733.exe
PID 1632 wrote to memory of 1784	1632	PO_6733.exe	PO_6733.exe
PID 1632 wrote to memory of 1784	1632	PO_6733.exe	PO_6733.exe
PID 1632 wrote to memory of 1784	1632	PO_6733.exe	PO_6733.exe

C:\Users\Admin\AppData\Local\Temp\PO_6733.exe
"C:\Users\Admin\AppData\Local\Temp\PO_6733.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ogOazdrNW.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:772

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ogOazdrNW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBC1F.tmp"
2⤵
- Creates scheduled task(s)
PID:1392

C:\Users\Admin\AppData\Local\Temp\PO_6733.exe
"C:\Users\Admin\AppData\Local\Temp\PO_6733.exe"
2⤵
PID:1784

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpBC1F.tmp
Filesize
1KB

MD5
c0d79192e17f35ba7d6b61a323c79b2f

SHA1
2b8829a686c1a00e250e4ac0ec29c61db6afc88f

SHA256
5166cbc066219b14de4d6ceed3ab76c9a3c3b39a0c3aa191e27e79317a1a8254

SHA512
776896472b7b56a6721bc3a952cfa2b44317602449fcbce568101161a8da666201f29da18402f155ba3eccea42c5410e87dc315abcfdafb6570ea7747370a6cc

Download Submit
memory/772-80-0x0000000074770000-0x0000000074D1B000-memory.dmp

Filesize
5.7MB

Download
memory/772-59-0x0000000000000000-mapping.dmp

Download
memory/772-81-0x0000000074770000-0x0000000074D1B000-memory.dmp

Filesize
5.7MB

Download
memory/1392-60-0x0000000000000000-mapping.dmp

Download
memory/1632-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1632-56-0x00000000004D0000-0x00000000004E0000-memory.dmp

Filesize
64KB

Download
memory/1632-57-0x0000000000550000-0x000000000055A000-memory.dmp

Filesize
40KB

Download
memory/1632-58-0x00000000048E0000-0x0000000004948000-memory.dmp

Filesize
416KB

Download
memory/1632-63-0x0000000004D80000-0x0000000004DB0000-memory.dmp

Filesize
192KB

Download
memory/1632-54-0x0000000000B60000-0x0000000000C1A000-memory.dmp

Filesize
744KB

Download
memory/1784-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1784-69-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1784-70-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1784-71-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1784-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1784-75-0x000000000040242D-mapping.dmp

Download
memory/1784-74-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1784-78-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1784-79-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1784-67-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1784-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads