netwire | c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f

General

Target

c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
Size

858KB
MD5

c51582aca3ed8628c84aa4e78a6d5521
SHA1

f69e5d553cd6848dc5f7de5128985beef992d98c
SHA256

c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f
SHA512

c9dfeb3606df191870bba01c26d3d5c2c76bd2c4756d17bee0af008e537bbbe578aaaa15a553d99517dc6752fc8c5b7fb3b4f6b9cecc1210ccdf0df4541c6901
SSDEEP

12288:H69/qA5V8TO2R+fOD1kL9p+ThiJH2ygiNUDJOgbiZU6XgS0OKPlGwZtD:qqA5VIXbKppEUZS8UAPXgVOKP9PD

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

212.193.30.230:3363

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Password@2
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1760-143-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/1760-145-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/1760-149-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/1760-161-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe

description	pid	process	target process
PID 1008 set thread context of 1760	1008	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3140 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

3828 powershell.exe
3828 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3828 powershell.exe

pid	process
3140	schtasks.exe

pid	process
3828	powershell.exe
3828	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3828	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe

C:\Users\Admin\AppData\Local\Temp\c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
"C:\Users\Admin\AppData\Local\Temp\c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1008

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aUqvaV.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3828

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aUqvaV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp326A.tmp"
2⤵
- Creates scheduled task(s)
PID:3140

C:\Users\Admin\AppData\Local\Temp\c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
"C:\Users\Admin\AppData\Local\Temp\c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe"
2⤵
PID:1760

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp326A.tmp
Filesize
1KB

MD5
809c0622193c687390103da73154213b

SHA1
2a5ab1298e7e655502658fe195ccdad537741f15

SHA256
07b1fa5de88b62c08c9432cbbc773fac183e8f1ac3d4d29757de8ad0f777d395

SHA512
fc49c3fe226877d2e3b1eaa2e3ada1e12ef61c50e0c9ee516012e942dd2aaf2c1752ec3a38c298fc037fe7745ad31d31e065cba6c8dd7191a4f6c7112ac2ff2c

Download Submit
memory/1008-133-0x0000000005130000-0x00000000056D4000-memory.dmp

Filesize
5.6MB

Download
memory/1008-134-0x0000000004B80000-0x0000000004C12000-memory.dmp

Filesize
584KB

Download
memory/1008-135-0x0000000004B40000-0x0000000004B4A000-memory.dmp

Filesize
40KB

Download
memory/1008-136-0x0000000007330000-0x00000000073CC000-memory.dmp

Filesize
624KB

Download
memory/1008-132-0x00000000000D0000-0x00000000001AE000-memory.dmp

Filesize
888KB

Download
memory/1760-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1760-161-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1760-149-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1760-141-0x0000000000000000-mapping.dmp

Download
memory/1760-143-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3140-138-0x0000000000000000-mapping.dmp

Download
memory/3828-147-0x0000000005740000-0x00000000057A6000-memory.dmp

Filesize
408KB

Download
memory/3828-154-0x0000000007740000-0x0000000007DBA000-memory.dmp

Filesize
6.5MB

Download
memory/3828-142-0x0000000004FA0000-0x00000000055C8000-memory.dmp

Filesize
6.2MB

Download
memory/3828-148-0x00000000057B0000-0x0000000005816000-memory.dmp

Filesize
408KB

Download
memory/3828-139-0x00000000024D0000-0x0000000002506000-memory.dmp

Filesize
216KB

Download
memory/3828-150-0x0000000005E00000-0x0000000005E1E000-memory.dmp

Filesize
120KB

Download
memory/3828-151-0x00000000063D0000-0x0000000006402000-memory.dmp

Filesize
200KB

Download
memory/3828-152-0x0000000071400000-0x000000007144C000-memory.dmp

Filesize
304KB

Download
memory/3828-153-0x0000000006390000-0x00000000063AE000-memory.dmp

Filesize
120KB

Download
memory/3828-146-0x0000000004F20000-0x0000000004F42000-memory.dmp

Filesize
136KB

Download
memory/3828-155-0x0000000007100000-0x000000000711A000-memory.dmp

Filesize
104KB

Download
memory/3828-156-0x0000000007170000-0x000000000717A000-memory.dmp

Filesize
40KB

Download
memory/3828-157-0x0000000007380000-0x0000000007416000-memory.dmp

Filesize
600KB

Download
memory/3828-158-0x0000000007330000-0x000000000733E000-memory.dmp

Filesize
56KB

Download
memory/3828-159-0x0000000007440000-0x000000000745A000-memory.dmp

Filesize
104KB

Download
memory/3828-160-0x0000000007420000-0x0000000007428000-memory.dmp

Filesize
32KB

Download
memory/3828-137-0x0000000000000000-mapping.dmp

Download

description	pid	process	target process
PID 1008 wrote to memory of 3828	1008	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	powershell.exe
PID 1008 wrote to memory of 3828	1008	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	powershell.exe
PID 1008 wrote to memory of 3828	1008	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	powershell.exe
PID 1008 wrote to memory of 3140	1008	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	schtasks.exe
PID 1008 wrote to memory of 3140	1008	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	schtasks.exe
PID 1008 wrote to memory of 3140	1008	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	schtasks.exe
PID 1008 wrote to memory of 1760	1008	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1008 wrote to memory of 1760	1008	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1008 wrote to memory of 1760	1008	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1008 wrote to memory of 1760	1008	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1008 wrote to memory of 1760	1008	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1008 wrote to memory of 1760	1008	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1008 wrote to memory of 1760	1008	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1008 wrote to memory of 1760	1008	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1008 wrote to memory of 1760	1008	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1008 wrote to memory of 1760	1008	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe
PID 1008 wrote to memory of 1760	1008	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe	c30890cf168e8b2bee51789f1c6f7fc9d5f7bb293aceb33eb674d2b4aefb2b2f.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads