netwire | ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7

General

Target

ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe
Size

231KB
MD5

85d1383f02b7ce7df6c885b26dec358f
SHA1

36b4d98651e805ae6221a34fc32ded9e29dc2202
SHA256

ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7
SHA512

9fe7ed08fea7256de6def7d3b7848f099753a4ed6365dc8fc3871d5c355ae12870d4a8858897e7a5537080ff2471274f40bb8746755ed2e55e40665edbc9f568
SSDEEP

6144:sIQQvbRHrYO7oHO7ADvifoFHig7wK2zU0uNE22Sv:VBThrYO7UzQEXwK2zU0uNE22S

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

haija.mine.nu:9999

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
Aegistools
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
qays1122
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 11 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1948-55-0x0000000000540000-0x000000000057C000-memory.dmp	netwire
behavioral1/memory/1948-56-0x0000000000830000-0x0000000000863000-memory.dmp	netwire
behavioral1/memory/1948-59-0x0000000000970000-0x00000000009A3000-memory.dmp	netwire
behavioral1/memory/1496-65-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1496-66-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1496-67-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1496-69-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1496-71-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1496-70-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1496-74-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1496-75-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlog.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winlog.exe"	ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe

description	pid	process	target process
PID 1948 set thread context of 1496	1948	ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe	svchost.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe

description	pid	process	target process
PID 1948 wrote to memory of 1496	1948	ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe	svchost.exe
PID 1948 wrote to memory of 1496	1948	ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe	svchost.exe
PID 1948 wrote to memory of 1496	1948	ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe	svchost.exe
PID 1948 wrote to memory of 1496	1948	ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe	svchost.exe
PID 1948 wrote to memory of 1496	1948	ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe	svchost.exe
PID 1948 wrote to memory of 1496	1948	ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe	svchost.exe
PID 1948 wrote to memory of 1496	1948	ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe	svchost.exe
PID 1948 wrote to memory of 1496	1948	ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe	svchost.exe
PID 1948 wrote to memory of 1496	1948	ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe	svchost.exe
PID 1948 wrote to memory of 1496	1948	ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe	svchost.exe
PID 1948 wrote to memory of 1496	1948	ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe	svchost.exe
PID 1948 wrote to memory of 1496	1948	ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe
"C:\Users\Admin\AppData\Local\Temp\ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWow64\svchost.exe
"C:\\Windows\\SysWow64\\svchost.exe"
2⤵
PID:1496

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-69-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1496-71-0x000000000040242D-mapping.dmp

Download
memory/1496-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1496-66-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1496-60-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1496-74-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1496-63-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1496-61-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1496-75-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1496-73-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1496-70-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1496-67-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1948-59-0x0000000000970000-0x00000000009A3000-memory.dmp

Filesize
204KB

Download
memory/1948-54-0x000000013FA60000-0x000000013FAA0000-memory.dmp

Filesize
256KB

Download
memory/1948-57-0x0000000000830000-0x0000000000846000-memory.dmp

Filesize
88KB

Download
memory/1948-56-0x0000000000830000-0x0000000000863000-memory.dmp

Filesize
204KB

Download
memory/1948-55-0x0000000000540000-0x000000000057C000-memory.dmp

Filesize
240KB

Download
memory/1948-58-0x0000000000590000-0x0000000000594000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads