netwire | zmr7[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
zmr7.exe
Size 9.1MB
Sample240108-b6v3asafe6
SHA256 984071c0054069029075b43afe125cd12bc3f9f70e384ca023cf70ea76a326d7
MD5 d037a430034a3d80c1ab9573c8c0b5a3
SHA1 abfc45d543920e955b9016dbc2e461ff862a5c7f
SHA512 806a41f2ce4821e507ae615a5e501128a6854e3468369010f67a3f70a65bfef18c5c473f6347ecccf997d5d0b2ccce86018fcb2740296718ccda5ba6da0f230b
SSDEEP 196608:y10ZfU3tLT+MeZQ1DTXP2NJEIYJ91TmKmt5p:ymZfU3AZQ1TXwEIYFTnmt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat netwire

Malware Config

Signatures

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
sample	netwire

Netwire family
netwire

File Explorer

zmr7.exe

.exe 9.1MB

zmr7.exe

IMPHASH f3cff4688da01cc28b5616015bd72db3
SHA256 984071c0054069029075b43afe125cd12bc3f9f70e384ca023cf70ea76a326d7
MD5 d037a430034a3d80c1ab9573c8c0b5a3
SHA1 abfc45d543920e955b9016dbc2e461ff862a5c7f
SHA512 806a41f2ce4821e507ae615a5e501128a6854e3468369010f67a3f70a65bfef18c5c473f6347ecccf997d5d0b2ccce86018fcb2740296718ccda5ba6da0f230b
SSDEEP 196608:y10ZfU3tLT+MeZQ1DTXP2NJEIYJ91TmKmt5p:ymZfU3AZQ1TXwEIYFTnmt
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NetWire RAT payload

rat

PE Signature issue

Digest

96:90:f5:ab:aa:c6:c1:6d:53:60:b3:7c:7f:af:2e:eb:64:ca:87:3e:79:0e:3f:db:8f:d9:3c:c7:9c:bb:98:5b

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Chains

Dec 15, 2022

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Serial Number

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 7, 2021 - Oct 9, 2024

Minor OS version

Major OS version

Entry point

4443872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFullPathNameW WriteFile SetLastError Sleep GetCurrentProcessId GetSystemDirectoryA GetVersionExA GetModuleFileNameW GlobalAlloc GlobalUnlock GlobalLock MoveFileExW VerifyVersionInfoW MultiByteToWideChar RaiseException GetCurrentThread SetThreadPriority WideCharToMultiByte DeleteFileW CreateFileA WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW HeapFree HeapAlloc CreateDirectoryW ExpandEnvironmentStringsA VerSetConditionMask GlobalFree GetFileAttributesW FindFirstFileW FindClose CreateFileW OutputDebugStringA FormatMessageA GetCurrentThreadId GetCurrentProcess WaitForMultipleObjects CreateEventA WaitForSingleObject ResetEvent SetEvent GetLastError LeaveCriticalSection EnterCriticalSection DeviceIoControl GetModuleHandleA OpenProcess GetExitCodeProcess CloseHandle FreeLibrary LoadLibraryA LocalFree GetProcAddress GetTimeZoneInformation HeapValidate HeapSize SetFilePointerEx SetConsoleCtrlHandler GetConsoleOutputCP FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetModuleHandleExW FreeLibraryAndExitThread RtlUnwind InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter CreateEventW GetCPInfo LCMapStringEx DecodePointer EncodePointer GetStringTypeW InitOnceComplete InitOnceBeginInitialize SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock GetTimeFormatW GetDateFormatW GetCurrentDirectoryW FindNextFileW GetSystemInfo VirtualProtect VirtualQuery GetModuleHandleW LoadLibraryExA GetStdHandle GetEnvironmentVariableW GetFileType InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber QueryPerformanceCounter GetSystemTimeAsFileTime FormatMessageW ConvertFiberToThread ConvertThreadToFiber GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSectionEx SleepEx GetTickCount64 WaitForSingleObjectEx ReadFile PeekNamedPipe VerifyVersionInfoA ExitProcess GetSystemTime SystemTimeToFileTime InitializeCriticalSection GetCommandLineW TerminateProcess GlobalMemoryStatusEx VirtualAlloc GetModuleFileNameA LocalAlloc IsDebuggerPresent GetCommandLineA GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation GetProcessAffinityMask TryEnterCriticalSection SwitchToThread CreateThread OpenThread GetExitCodeThread SetThreadAffinityMask QueryPerformanceFrequency SetUnhandledExceptionFilter LoadLibraryExW LoadLibraryW ExitThread DebugBreak GetProcessHeaps SetProcessAffinityMask SetEnvironmentVariableW FindFirstFileExW FlushFileBuffers GetDiskFreeSpaceA GetDriveTypeW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx SetEndOfFile SetFilePointer SetFileTime

user32

GetProcessWindowStation DialogBoxParamA IsWindowVisible EndDialog GetDlgItem SetDlgItemInt GetDlgItemInt SetDlgItemTextA OpenClipboard CloseClipboard GetUserObjectInformationW GetWindowRect EnumWindows SetClipboardData MessageBoxW EmptyClipboard GetWindowTextLengthA MessageBoxA GetDesktopWindow FlashWindowEx wsprintfA GetWindowThreadProcessId SetWindowPos

advapi32

RegOpenKeyExA RegQueryValueExA RegOpenKeyA RegCloseKey DeregisterEventSource RegisterEventSourceW ReportEventW

shell32

CommandLineToArgvW

ole32

CLSIDFromString

oleaut32

VariantClear

ws2_32

gethostname __WSAFDIsSet select getsockname htonl WSACleanup WSAEnumNetworkEvents WSAEventSelect WSASendTo getaddrinfo freeaddrinfo WSAGetLastError WSAStartup socket setsockopt sendto recvfrom htons getsockopt ntohs getnameinfo recv send WSASetLastError accept connect listen getpeername WSAIoctl ioctlsocket closesocket bind shutdown ntohl

psapi

GetProcessMemoryInfo

winmm

timeEndPeriod timeBeginPeriod

bcrypt

BCryptGenRandom

wldap32

ord32 ord33 ord35 ord79 ord26 ord200 ord301 ord46 ord217 ord143 ord211 ord22 ord27 ord41 ord30 ord50 ord60

Sharing

General

Malware Config

Signatures

File Explorer

zmr7.exe

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

psapi

winmm

bcrypt

wldap32

generic