netwire | 6b2b444ceaeae71822fa96af46e16c4227876be7e176934a857e2999025f0870

General

Target

4f993bfaf9966c5521f3ebe21d1ad6d6.exe
Size

561KB
MD5

4f993bfaf9966c5521f3ebe21d1ad6d6
SHA1

78920a2e07065b5344459aacf5bbc956d7b93165
SHA256

6b2b444ceaeae71822fa96af46e16c4227876be7e176934a857e2999025f0870
SHA512

3bc1fc5dff58d69b0f17cb994ae68773f7c24a70bc140fdf630d12dbd54f1324e159642bf205072b0294d7d953ce868debb0c6a2eb9a4fd4e041e0e20664fe6d
SSDEEP

12288:PM9p+gczyhNSvRbBQHR4qz91hI0zSaNsvz+yuWDVId21NaI+E8tyvX5La+NcphyQ:PBNAhyjH44lWKSMftcL1My

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

194.5.97.220:3387

194.5.97.220:3389

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
stanlow02
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 6 IoCs

rat

resource	yara_rule
behavioral1/memory/2816-21-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/2816-23-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/2816-18-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/2816-17-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/2816-16-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/2816-15-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2992 set thread context of 2816	2992	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process
2656	2816	WerFault.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2856	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2992	4f993bfaf9966c5521f3ebe21d1ad6d6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2992	4f993bfaf9966c5521f3ebe21d1ad6d6.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2856	2992	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	29
PID 2992 wrote to memory of 2856	2992	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	29
PID 2992 wrote to memory of 2856	2992	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	29
PID 2992 wrote to memory of 2856	2992	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	29
PID 2992 wrote to memory of 2816	2992	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	31
PID 2992 wrote to memory of 2816	2992	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	31
PID 2992 wrote to memory of 2816	2992	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	31
PID 2992 wrote to memory of 2816	2992	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	31
PID 2992 wrote to memory of 2816	2992	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	31
PID 2992 wrote to memory of 2816	2992	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	31
PID 2992 wrote to memory of 2816	2992	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	31
PID 2992 wrote to memory of 2816	2992	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	31
PID 2992 wrote to memory of 2816	2992	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	31
PID 2992 wrote to memory of 2816	2992	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	31
PID 2992 wrote to memory of 2816	2992	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	31
PID 2992 wrote to memory of 2816	2992	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	31
PID 2816 wrote to memory of 2656	2816	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	30
PID 2816 wrote to memory of 2656	2816	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	30
PID 2816 wrote to memory of 2656	2816	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	30
PID 2816 wrote to memory of 2656	2816	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	30

C:\Users\Admin\AppData\Local\Temp\4f993bfaf9966c5521f3ebe21d1ad6d6.exe
"C:\Users\Admin\AppData\Local\Temp\4f993bfaf9966c5521f3ebe21d1ad6d6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yHmqWJg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9C9D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2856
- C:\Users\Admin\AppData\Local\Temp\4f993bfaf9966c5521f3ebe21d1ad6d6.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 140
1⤵
- Program crash
PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9C9D.tmp

Filesize
1KB

MD5
bfd3cca4a444e8ca009a7c722dce71d7

SHA1
89fccdd31d4cd2827ffa57ed12fac084490c1f26

SHA256
37feee871e233534d6fcbd5e54b9d769c912a5d2770b357a3019ad10fe7659aa

SHA512
da11956938a45a95acd7668555aee9f160979c557469168a199fa84e52e98d457bd8497320d834329489e322401ad5282e068b34d3b6082c43c81275848e1b49

Download Submit
memory/2816-15-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2816-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2816-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2816-23-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2816-13-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2816-14-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2816-21-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2816-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2816-18-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2816-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2992-4-0x0000000074B90000-0x000000007527E000-memory.dmp

Filesize
6.9MB

Download
memory/2992-2-0x0000000004E70000-0x0000000004EB0000-memory.dmp

Filesize
256KB

Download
memory/2992-1-0x0000000074B90000-0x000000007527E000-memory.dmp

Filesize
6.9MB

Download
memory/2992-7-0x0000000000B80000-0x0000000000BCC000-memory.dmp

Filesize
304KB

Download
memory/2992-0-0x0000000001100000-0x0000000001192000-memory.dmp

Filesize
584KB

Download
memory/2992-6-0x0000000004950000-0x00000000049E6000-memory.dmp

Filesize
600KB

Download
memory/2992-5-0x0000000004E70000-0x0000000004EB0000-memory.dmp

Filesize
256KB

Download
memory/2992-3-0x0000000000350000-0x0000000000358000-memory.dmp

Filesize
32KB

Download
memory/2992-24-0x0000000074B90000-0x000000007527E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads