netwire | f4847c104fe539b564332b0a7a3ab3d83c046335a9ef7ce700d921b67834c249

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 15:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dce630587d764f269da604a1f3637b99.exe
Size 305KB
Sample231222-s37qcsacej
SHA256 f4847c104fe539b564332b0a7a3ab3d83c046335a9ef7ce700d921b67834c249
MD5 dce630587d764f269da604a1f3637b99
SHA1 f8055d5c3f54a76db454be3c47e7c6452e7e05d0
SHA512 d3e8a357cc33694419813c3dfd29d5d30dfa2cbf96c6f3935808d1a29db07d7ef2412d605011ce708b4271d6e59e4929f654701c07e1c1597208102404811313
SSDEEP 6144:LHPhCICIBLCTodEEOYchRR5TCwMQLva+StyYKU/WuH:FGfxnvCwTD5U/Wu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

bright1.awsmppl.com:4770

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/2608-11-0x0000000000400000-0x0000000000430000-memory.dmp	netwire
behavioral2/memory/2608-12-0x0000000000400000-0x0000000000430000-memory.dmp	netwire
behavioral2/memory/2608-7-0x0000000000400000-0x0000000000430000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	dce630587d764f269da604a1f3637b99.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pcsllwn.exe.lnk	dce630587d764f269da604a1f3637b99.exe

Executes dropped EXE 1 IoCs

pid	Process
2608	svhost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4908 set thread context of 2608	4908	dce630587d764f269da604a1f3637b99.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\PcHelp\pcsllwn.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4908	dce630587d764f269da604a1f3637b99.exe
4908	dce630587d764f269da604a1f3637b99.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4908	dce630587d764f269da604a1f3637b99.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 2608	4908	dce630587d764f269da604a1f3637b99.exe	92
PID 4908 wrote to memory of 2608	4908	dce630587d764f269da604a1f3637b99.exe	92
PID 4908 wrote to memory of 2608	4908	dce630587d764f269da604a1f3637b99.exe	92
PID 4908 wrote to memory of 2608	4908	dce630587d764f269da604a1f3637b99.exe	92
PID 4908 wrote to memory of 2608	4908	dce630587d764f269da604a1f3637b99.exe	92
PID 4908 wrote to memory of 2608	4908	dce630587d764f269da604a1f3637b99.exe	92
PID 4908 wrote to memory of 2608	4908	dce630587d764f269da604a1f3637b99.exe	92
PID 4908 wrote to memory of 2608	4908	dce630587d764f269da604a1f3637b99.exe	92
PID 4908 wrote to memory of 2608	4908	dce630587d764f269da604a1f3637b99.exe	92
PID 4908 wrote to memory of 2608	4908	dce630587d764f269da604a1f3637b99.exe	92
PID 4908 wrote to memory of 4760	4908	dce630587d764f269da604a1f3637b99.exe	94
PID 4908 wrote to memory of 4760	4908	dce630587d764f269da604a1f3637b99.exe	94
PID 4908 wrote to memory of 4760	4908	dce630587d764f269da604a1f3637b99.exe	94
PID 4908 wrote to memory of 1544	4908	dce630587d764f269da604a1f3637b99.exe	96
PID 4908 wrote to memory of 1544	4908	dce630587d764f269da604a1f3637b99.exe	96
PID 4908 wrote to memory of 1544	4908	dce630587d764f269da604a1f3637b99.exe	96

C:\Users\Admin\AppData\Local\Temp\dce630587d764f269da604a1f3637b99.exe
"C:\Users\Admin\AppData\Local\Temp\dce630587d764f269da604a1f3637b99.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/dce630587d764f269da604a1f3637b99.exe" "%temp%\PcHelp\pcsllwn.exe" /Y
  2⤵
  PID:4760
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\PcHelp\pcsllwn.exe:Zone.Identifier
  2⤵
  - NTFS ADS
  PID:1544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pcsllwn.exe

Path C:\Users\Admin\AppData\Local\Temp\PcHelp\pcsllwn.exe
Size 24KB
SHA256 b677898423bc6f3673f2ff4cfd06d9987a61293a05c37ee88b3b8f5d5dcef3fb
MD5 84f8cd9647282cf45fb725cd4998bd1e
SHA1 7900be2fc778410776591f1ba5cdf01144adbd82
SHA512 0e568b1e9bfbd7906a063b2ebe31f0a739cc4a2be2077cc341a82f79c7b55a94a83de2b676975f4af9da11be1a331962546b68a5a33ac82ec65040ff9cd8ea02
SSDEEP 384:QN2dfh3b76UVAUzVY2eWhIAu9W5+VqthMWIiWn7+Ea6KsmGejwyiyMGm+066q8WY:C2df8UVAURY2eW/UW5+sthN/J9mX
MD5 SHA1 SHA512 SSDEEP

Submit Download

svhost.exe

Path C:\Users\Admin\AppData\Local\Temp\svhost.exe
Size 35KB
SHA256 6f468ee04b3af99927575b7edb17ac25f5d2c9213a60f337d21ed02dff00404f
MD5 93876e1f4058dd08bd7080d09288795f
SHA1 2b72b1fadcd74a64c73cb7d16de60bcce12307a0
SHA512 d7fbb3c2431db59bb827842296c4863c89036664e2e4de67f899f1246f21884d10a430f7deeee35fada106b7d034c108e51da0f25c7a733e560e6cb81aa20ec0
SSDEEP 384:XVaPtfbCLolflKfFfPktFN1H9F9hi6Nj5QPrqw789/hZo3gcGxPWu55mHz7AqN:FWfApXk11dhnDQPr2rxLmHz7AqN
MD5 SHA1 SHA512 SSDEEP

Submit Download

svhost.exe

Path C:\Users\Admin\AppData\Local\Temp\svhost.exe
Size 138KB
SHA256 f92934a64ec9c22e7a83cf5f0c74246b07203afc89ddca067316dfe2775b4475
MD5 937cf1502dcfdb9eb3b4ac54af3d514c
SHA1 bdfe8ab98936f37120a22fcf981bbff1b5e5731c
SHA512 8ca81fe1e6658628676acb0b0ef5bbdbd5259f6f683d05e0a529bf5ff0bc456341f9928af2df0d5989d408fda177bc519294e1246056b278990860e6586b63ca
SSDEEP 1536:Fu0XodhDorEKHRuD+T4CIwhKUhDT7aZcTByg+d:FuHdh4fxuD+T4eDT7aZcTByg+d
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2608-11-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2608-12-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2608-7-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4908-1-0x0000000075280000-0x0000000075A30000-memory.dmp

Download

memory/4908-0-0x0000000000A00000-0x0000000000A52000-memory.dmp

Download

memory/4908-3-0x00000000054C0000-0x00000000054D0000-memory.dmp

Download

memory/4908-2-0x0000000005400000-0x000000000549C000-memory.dmp

Download

memory/4908-4-0x00000000053D0000-0x00000000053FE000-memory.dmp

Download

memory/4908-20-0x0000000075280000-0x0000000075A30000-memory.dmp

Download