netwire | 6b2b444ceaeae71822fa96af46e16c4227876be7e176934a857e2999025f0870

General

Target

4f993bfaf9966c5521f3ebe21d1ad6d6.exe
Size

561KB
MD5

4f993bfaf9966c5521f3ebe21d1ad6d6
SHA1

78920a2e07065b5344459aacf5bbc956d7b93165
SHA256

6b2b444ceaeae71822fa96af46e16c4227876be7e176934a857e2999025f0870
SHA512

3bc1fc5dff58d69b0f17cb994ae68773f7c24a70bc140fdf630d12dbd54f1324e159642bf205072b0294d7d953ce868debb0c6a2eb9a4fd4e041e0e20664fe6d
SSDEEP

12288:PM9p+gczyhNSvRbBQHR4qz91hI0zSaNsvz+yuWDVId21NaI+E8tyvX5La+NcphyQ:PBNAhyjH44lWKSMftcL1My

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

194.5.97.220:3387

194.5.97.220:3389

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
stanlow02
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/4268-13-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/4268-16-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/4268-18-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	4f993bfaf9966c5521f3ebe21d1ad6d6.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4336 set thread context of 4268	4336	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2136	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4336	4f993bfaf9966c5521f3ebe21d1ad6d6.exe
4336	4f993bfaf9966c5521f3ebe21d1ad6d6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4336	4f993bfaf9966c5521f3ebe21d1ad6d6.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 2136	4336	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	103
PID 4336 wrote to memory of 2136	4336	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	103
PID 4336 wrote to memory of 2136	4336	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	103
PID 4336 wrote to memory of 4268	4336	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	104
PID 4336 wrote to memory of 4268	4336	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	104
PID 4336 wrote to memory of 4268	4336	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	104
PID 4336 wrote to memory of 4268	4336	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	104
PID 4336 wrote to memory of 4268	4336	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	104
PID 4336 wrote to memory of 4268	4336	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	104
PID 4336 wrote to memory of 4268	4336	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	104
PID 4336 wrote to memory of 4268	4336	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	104
PID 4336 wrote to memory of 4268	4336	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	104
PID 4336 wrote to memory of 4268	4336	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	104
PID 4336 wrote to memory of 4268	4336	4f993bfaf9966c5521f3ebe21d1ad6d6.exe	104

C:\Users\Admin\AppData\Local\Temp\4f993bfaf9966c5521f3ebe21d1ad6d6.exe
"C:\Users\Admin\AppData\Local\Temp\4f993bfaf9966c5521f3ebe21d1ad6d6.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yHmqWJg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCAF1.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2136
- C:\Users\Admin\AppData\Local\Temp\4f993bfaf9966c5521f3ebe21d1ad6d6.exe
  "{path}"
  2⤵
  PID:4268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpCAF1.tmp

Filesize
1KB

MD5
3ffc55ad67332d073e7793744c96a238

SHA1
4ed37a69ede0935b0ce4dd630f55d8a493636f56

SHA256
432400b4a2e112da496391a6dcc3b7342f470c8c8727a72d199263a3cbc358cc

SHA512
4c5e9e544cb6275b337e60272beebb3c0fc187e4281a085fc8156c0de1c8a4e9cb52be19d6ede756262e35baf350ec4ecbfed2c68ee4f99f36f1feac55701294

Download Submit
memory/4268-13-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4268-18-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4268-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4336-6-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/4336-3-0x0000000005220000-0x0000000005228000-memory.dmp

Filesize
32KB

Download
memory/4336-0-0x00000000008E0000-0x0000000000972000-memory.dmp

Filesize
584KB

Download
memory/4336-7-0x0000000005420000-0x0000000005430000-memory.dmp

Filesize
64KB

Download
memory/4336-8-0x0000000005DA0000-0x0000000005E36000-memory.dmp

Filesize
600KB

Download
memory/4336-9-0x00000000081D0000-0x000000000821C000-memory.dmp

Filesize
304KB

Download
memory/4336-4-0x0000000005520000-0x00000000055B2000-memory.dmp

Filesize
584KB

Download
memory/4336-5-0x00000000055C0000-0x000000000565C000-memory.dmp

Filesize
624KB

Download
memory/4336-17-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/4336-2-0x0000000005420000-0x0000000005430000-memory.dmp

Filesize
64KB

Download
memory/4336-1-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads