netwire | c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f

General

Target

c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
Size

858KB
MD5

c51582aca3ed8628c84aa4e78a6d5521
SHA1

f69e5d553cd6848dc5f7de5128985beef992d98c
SHA256

c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f
SHA512

c9dfeb3606df191870bba01c26d3d5c2c76bd2c4756d17bee0af008e537bbbe578aaaa15a553d99517dc6752fc8c5b7fb3b4f6b9cecc1210ccdf0df4541c6901
SSDEEP

12288:H69/qA5V8TO2R+fOD1kL9p+ThiJH2ygiNUDJOgbiZU6XgS0OKPlGwZtD:qqA5VIXbKppEUZS8UAPXgVOKP9PD

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

212.193.30.230:3363

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Password@2
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/5040-143-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/5040-145-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/5040-146-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/5040-161-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe

description	pid	process	target process
PID 1956 set thread context of 5040	1956	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3136 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

3884 powershell.exe
3884 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3884 powershell.exe

pid	process
3136	schtasks.exe

pid	process
3884	powershell.exe
3884	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3884	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe

C:\Users\Admin\AppData\Local\Temp\c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
"C:\Users\Admin\AppData\Local\Temp\c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aUqvaV.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3884

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aUqvaV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp17AE.tmp"
2⤵
- Creates scheduled task(s)
PID:3136

C:\Users\Admin\AppData\Local\Temp\c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
"C:\Users\Admin\AppData\Local\Temp\c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe"
2⤵
PID:5040

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp17AE.tmp
Filesize
1KB

MD5
809c0622193c687390103da73154213b

SHA1
2a5ab1298e7e655502658fe195ccdad537741f15

SHA256
07b1fa5de88b62c08c9432cbbc773fac183e8f1ac3d4d29757de8ad0f777d395

SHA512
fc49c3fe226877d2e3b1eaa2e3ada1e12ef61c50e0c9ee516012e942dd2aaf2c1752ec3a38c298fc037fe7745ad31d31e065cba6c8dd7191a4f6c7112ac2ff2c

Download Submit
memory/1956-133-0x0000000005A60000-0x0000000006004000-memory.dmp

Filesize
5.6MB

Download
memory/1956-134-0x00000000054B0000-0x0000000005542000-memory.dmp

Filesize
584KB

Download
memory/1956-135-0x0000000005490000-0x000000000549A000-memory.dmp

Filesize
40KB

Download
memory/1956-136-0x0000000007C40000-0x0000000007CDC000-memory.dmp

Filesize
624KB

Download
memory/1956-132-0x0000000000A10000-0x0000000000AEE000-memory.dmp

Filesize
888KB

Download
memory/3136-138-0x0000000000000000-mapping.dmp

Download
memory/3884-147-0x0000000004A40000-0x0000000004A62000-memory.dmp

Filesize
136KB

Download
memory/3884-156-0x0000000006E90000-0x0000000006E9A000-memory.dmp

Filesize
40KB

Download
memory/3884-142-0x0000000004CE0000-0x0000000005308000-memory.dmp

Filesize
6.2MB

Download
memory/3884-160-0x0000000007140000-0x0000000007148000-memory.dmp

Filesize
32KB

Download
memory/3884-159-0x0000000007160000-0x000000000717A000-memory.dmp

Filesize
104KB

Download
memory/3884-158-0x0000000007050000-0x000000000705E000-memory.dmp

Filesize
56KB

Download
memory/3884-157-0x00000000070A0000-0x0000000007136000-memory.dmp

Filesize
600KB

Download
memory/3884-137-0x0000000000000000-mapping.dmp

Download
memory/3884-148-0x00000000053C0000-0x0000000005426000-memory.dmp

Filesize
408KB

Download
memory/3884-149-0x00000000054E0000-0x0000000005546000-memory.dmp

Filesize
408KB

Download
memory/3884-150-0x0000000005B20000-0x0000000005B3E000-memory.dmp

Filesize
120KB

Download
memory/3884-151-0x00000000060F0000-0x0000000006122000-memory.dmp

Filesize
200KB

Download
memory/3884-152-0x0000000071190000-0x00000000711DC000-memory.dmp

Filesize
304KB

Download
memory/3884-153-0x00000000060D0000-0x00000000060EE000-memory.dmp

Filesize
120KB

Download
memory/3884-154-0x0000000007470000-0x0000000007AEA000-memory.dmp

Filesize
6.5MB

Download
memory/3884-155-0x0000000006E20000-0x0000000006E3A000-memory.dmp

Filesize
104KB

Download
memory/3884-139-0x0000000004590000-0x00000000045C6000-memory.dmp

Filesize
216KB

Download
memory/5040-146-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5040-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5040-143-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5040-141-0x0000000000000000-mapping.dmp

Download
memory/5040-161-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

description	pid	process	target process
PID 1956 wrote to memory of 3884	1956	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	powershell.exe
PID 1956 wrote to memory of 3884	1956	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	powershell.exe
PID 1956 wrote to memory of 3884	1956	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	powershell.exe
PID 1956 wrote to memory of 3136	1956	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	schtasks.exe
PID 1956 wrote to memory of 3136	1956	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	schtasks.exe
PID 1956 wrote to memory of 3136	1956	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	schtasks.exe
PID 1956 wrote to memory of 5040	1956	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1956 wrote to memory of 5040	1956	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1956 wrote to memory of 5040	1956	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1956 wrote to memory of 5040	1956	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1956 wrote to memory of 5040	1956	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1956 wrote to memory of 5040	1956	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1956 wrote to memory of 5040	1956	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1956 wrote to memory of 5040	1956	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1956 wrote to memory of 5040	1956	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1956 wrote to memory of 5040	1956	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1956 wrote to memory of 5040	1956	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads