netwire | c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f

General

Target

c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
Size

858KB
MD5

c51582aca3ed8628c84aa4e78a6d5521
SHA1

f69e5d553cd6848dc5f7de5128985beef992d98c
SHA256

c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f
SHA512

c9dfeb3606df191870bba01c26d3d5c2c76bd2c4756d17bee0af008e537bbbe578aaaa15a553d99517dc6752fc8c5b7fb3b4f6b9cecc1210ccdf0df4541c6901
SSDEEP

12288:H69/qA5V8TO2R+fOD1kL9p+ThiJH2ygiNUDJOgbiZU6XgS0OKPlGwZtD:qqA5VIXbKppEUZS8UAPXgVOKP9PD

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

212.193.30.230:3363

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Password@2
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1544-69-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1544-70-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1544-71-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1544-73-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1544-74-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1544-75-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1544-78-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1544-80-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

Processes:

c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe

description	pid	process	target process
PID 1724 set thread context of 1544	1724	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1864 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

520 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 520 powershell.exe

pid	process
1864	schtasks.exe

pid	process
520	powershell.exe

description	pid	process
Token: SeDebugPrivilege	520	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe

C:\Users\Admin\AppData\Local\Temp\c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
"C:\Users\Admin\AppData\Local\Temp\c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aUqvaV.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:520

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aUqvaV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA999.tmp"
2⤵
- Creates scheduled task(s)
PID:1864

C:\Users\Admin\AppData\Local\Temp\c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
"C:\Users\Admin\AppData\Local\Temp\c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe"
2⤵
PID:1544

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA999.tmp
Filesize
1KB

MD5
bbc8c46643085f69b54e420d1344c21c

SHA1
4a44e528df2d64ca6fcd435200adf87bb99e7cf1

SHA256
ef696875a2bb9a433fe6194eea6423157187bea170ed0077174e30eded117625

SHA512
f67f189dbf093ad0e13662895ab166d5c46bca61ea3bbe89f393f7e9efd0c09c3ae7b6670e27796b15f22bd794172942240f987c3fc18ca3c80cdd3974b98122

Download Submit
memory/520-59-0x0000000000000000-mapping.dmp

Download
memory/520-81-0x000000006E580000-0x000000006EB2B000-memory.dmp

Filesize
5.7MB

Download
memory/520-79-0x000000006E580000-0x000000006EB2B000-memory.dmp

Filesize
5.7MB

Download
memory/1544-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1544-70-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1544-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1544-78-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1544-75-0x000000000040242D-mapping.dmp

Download
memory/1544-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1544-74-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1544-67-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1544-69-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1544-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1544-71-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1724-58-0x00000000052E0000-0x0000000005366000-memory.dmp

Filesize
536KB

Download
memory/1724-54-0x0000000000800000-0x00000000008DE000-memory.dmp

Filesize
888KB

Download
memory/1724-63-0x00000000041B0000-0x00000000041FC000-memory.dmp

Filesize
304KB

Download
memory/1724-57-0x00000000006F0000-0x00000000006FA000-memory.dmp

Filesize
40KB

Download
memory/1724-56-0x0000000000530000-0x0000000000546000-memory.dmp

Filesize
88KB

Download
memory/1724-55-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/1864-60-0x0000000000000000-mapping.dmp

Download

description	pid	process	target process
PID 1724 wrote to memory of 520	1724	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	powershell.exe
PID 1724 wrote to memory of 520	1724	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	powershell.exe
PID 1724 wrote to memory of 520	1724	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	powershell.exe
PID 1724 wrote to memory of 520	1724	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	powershell.exe
PID 1724 wrote to memory of 1864	1724	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	schtasks.exe
PID 1724 wrote to memory of 1864	1724	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	schtasks.exe
PID 1724 wrote to memory of 1864	1724	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	schtasks.exe
PID 1724 wrote to memory of 1864	1724	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	schtasks.exe
PID 1724 wrote to memory of 1544	1724	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1724 wrote to memory of 1544	1724	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1724 wrote to memory of 1544	1724	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1724 wrote to memory of 1544	1724	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1724 wrote to memory of 1544	1724	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1724 wrote to memory of 1544	1724	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1724 wrote to memory of 1544	1724	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1724 wrote to memory of 1544	1724	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1724 wrote to memory of 1544	1724	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1724 wrote to memory of 1544	1724	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1724 wrote to memory of 1544	1724	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1724 wrote to memory of 1544	1724	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads