netwire | d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b

General

Target

D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
Size

432KB
MD5

9b07a0fdaa64049e857b3982eeb3a575
SHA1

63d7d2eefd78ee4736243c8e32c305366603c579
SHA256

d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b
SHA512

49db3c66ee829534937ba0cc8f62f568cc04891b141e402d5c2c7961335efbd453f33bc57b218f9cf609b4a665df4b31810d4215d6e994c03934264b184c770a
SSDEEP

6144:SPn3xY3d6ND9D/S4mAC09X1Qd6pOzWqGLDUz7j42W3Llin:SLNoS1Y6pq1AUvjW3Un

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

forgiveme.workisboring.com:3360

Attributes

activex_autorun
true
activex_key
{TN38RH36-U670-03U7-57DE-24XMTWQBHGH1}
copy_executable
true
delete_original
false
host_id
bendal
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Password
registry_autorun
true
startup_name
centosffjk
use_mutex
false

Signatures

NetWire RAT payload 7 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3532-133-0x0000000000400000-0x0000000000470000-memory.dmp	netwire
behavioral2/memory/3532-138-0x0000000000400000-0x0000000000470000-memory.dmp	netwire
behavioral2/memory/1244-140-0x0000000000400000-0x0000000000470000-memory.dmp	netwire
behavioral2/memory/1244-148-0x0000000000400000-0x0000000000470000-memory.dmp	netwire
behavioral2/memory/1244-170-0x0000000000400000-0x0000000000470000-memory.dmp	netwire
behavioral2/memory/1244-172-0x0000000000400000-0x0000000000470000-memory.dmp	netwire
behavioral2/memory/1244-175-0x0000000000400000-0x0000000000470000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{TN38RH36-U670-03U7-57DE-24XMTWQBHGH1}	Host.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{TN38RH36-U670-03U7-57DE-24XMTWQBHGH1}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\""	Host.exe

Executes dropped EXE 1 IoCs

Processes:

Host.exe

pid process

1244 Host.exe

pid	process
1244	Host.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\centosffjk = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe"	Host.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe

pid	process
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exeHost.exe

pid process

3532 D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
1244 Host.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe

description	pid	process	target process
PID 3532 wrote to memory of 1244	3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe	Host.exe
PID 3532 wrote to memory of 1244	3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe	Host.exe
PID 3532 wrote to memory of 1244	3532	D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
"C:\Users\Admin\AppData\Local\Temp\D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3532

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1244

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
432KB

MD5
9b07a0fdaa64049e857b3982eeb3a575

SHA1
63d7d2eefd78ee4736243c8e32c305366603c579

SHA256
d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b

SHA512
49db3c66ee829534937ba0cc8f62f568cc04891b141e402d5c2c7961335efbd453f33bc57b218f9cf609b4a665df4b31810d4215d6e994c03934264b184c770a

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
432KB

MD5
9b07a0fdaa64049e857b3982eeb3a575

SHA1
63d7d2eefd78ee4736243c8e32c305366603c579

SHA256
d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b

SHA512
49db3c66ee829534937ba0cc8f62f568cc04891b141e402d5c2c7961335efbd453f33bc57b218f9cf609b4a665df4b31810d4215d6e994c03934264b184c770a

Download Submit
memory/1244-153-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-170-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1244-172-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1244-140-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1244-143-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-144-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-155-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-146-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-147-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-148-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1244-149-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-150-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-151-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-152-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-175-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1244-154-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-145-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-156-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-157-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-158-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-159-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-160-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-161-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-162-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-164-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-165-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-163-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-166-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/1244-167-0x00000000020C0000-0x00000000020CE000-memory.dmp

Filesize
56KB

Download
memory/3532-138-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3532-139-0x0000000000640000-0x000000000067A000-memory.dmp

Filesize
232KB

Download
memory/3532-133-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads