netwire | c7e06f4529c5b7713ce51085a19c975324911c3d5100f107a806028c62c05387

Analysis

max time kernel
154s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae38b9a7547fc23847bbb04923a2a4e9.exe
Size

1.3MB
MD5

ae38b9a7547fc23847bbb04923a2a4e9
SHA1

d63feb534ed6d4bf31f2c7603eb0d79980a2e52f
SHA256

c7e06f4529c5b7713ce51085a19c975324911c3d5100f107a806028c62c05387
SHA512

62a5b00fc860874b26883ff8d5724a4d429f34062b3667356f6dcf97d9390a2bb15e3ae0c3adad80e03984357d92af921bdaf8b0d53497f29b6f7ae93f26e687
SSDEEP

24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWYx:8u0c++OCvkGs9Fa+rd1f26RaYx

Score

10^/10

netwire warzonerat botnet infostealer rat stealer

Malware Config

Extracted

Family

netwire

Wealthy2019.com.strangled.net:20190

wealthyme.ddns.net:20190

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
sunshineslisa
install_path
%AppData%\Imgburn\Host.exe
keylogger_dir
%AppData%\Logs\Imgburn\
lock_executable
false
offline_keylogger
true
password
sucess
registry_autorun
false
use_mutex
false

Extracted

Family

warzonerat

wealth.warzonedns.com:5202

Signatures

NetWire RAT payload 14 IoCs

rat

resource	yara_rule
behavioral2/files/0x0008000000023155-4.dat	netwire
behavioral2/files/0x0008000000023155-7.dat	netwire
behavioral2/memory/4108-22-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/files/0x000800000002316c-20.dat	netwire
behavioral2/memory/4688-26-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/4688-27-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/files/0x0008000000023178-28.dat	netwire
behavioral2/files/0x0008000000023178-29.dat	netwire
behavioral2/files/0x0008000000023178-45.dat	netwire
behavioral2/memory/2144-52-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/files/0x0008000000023178-61.dat	netwire
behavioral2/memory/2144-75-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/4292-77-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/4292-89-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/4260-9-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/4260-18-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	ae38b9a7547fc23847bbb04923a2a4e9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	RtDCpl64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	RtDCpl64.exe

Executes dropped EXE 8 IoCs

pid	Process
4108	Blasthost.exe
4688	Host.exe
2148	RtDCpl64.exe
2144	Blasthost.exe
1296	RtDCpl64.exe
4496	RtDCpl64.exe
4292	Blasthost.exe
1700	RtDCpl64.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0008000000023178-28.dat	autoit_exe
behavioral2/files/0x0008000000023178-29.dat	autoit_exe
behavioral2/files/0x0008000000023178-45.dat	autoit_exe
behavioral2/files/0x0008000000023178-61.dat	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4188 set thread context of 4260	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	93
PID 2148 set thread context of 1296	2148	RtDCpl64.exe	109
PID 4496 set thread context of 1700	4496	RtDCpl64.exe	125

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4720	schtasks.exe
4188	schtasks.exe
3196	schtasks.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 4108	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	91
PID 4188 wrote to memory of 4108	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	91
PID 4188 wrote to memory of 4108	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	91
PID 4188 wrote to memory of 4260	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	93
PID 4188 wrote to memory of 4260	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	93
PID 4188 wrote to memory of 4260	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	93
PID 4188 wrote to memory of 4260	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	93
PID 4188 wrote to memory of 4260	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	93
PID 4108 wrote to memory of 4688	4108	Blasthost.exe	98
PID 4108 wrote to memory of 4688	4108	Blasthost.exe	98
PID 4108 wrote to memory of 4688	4108	Blasthost.exe	98
PID 4260 wrote to memory of 1336	4260	ae38b9a7547fc23847bbb04923a2a4e9.exe	95
PID 4260 wrote to memory of 1336	4260	ae38b9a7547fc23847bbb04923a2a4e9.exe	95
PID 4260 wrote to memory of 1336	4260	ae38b9a7547fc23847bbb04923a2a4e9.exe	95
PID 4188 wrote to memory of 4720	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	97
PID 4188 wrote to memory of 4720	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	97
PID 4188 wrote to memory of 4720	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	97
PID 4260 wrote to memory of 1336	4260	ae38b9a7547fc23847bbb04923a2a4e9.exe	95
PID 4260 wrote to memory of 1336	4260	ae38b9a7547fc23847bbb04923a2a4e9.exe	95
PID 2148 wrote to memory of 2144	2148	RtDCpl64.exe	108
PID 2148 wrote to memory of 2144	2148	RtDCpl64.exe	108
PID 2148 wrote to memory of 2144	2148	RtDCpl64.exe	108
PID 2148 wrote to memory of 1296	2148	RtDCpl64.exe	109
PID 2148 wrote to memory of 1296	2148	RtDCpl64.exe	109
PID 2148 wrote to memory of 1296	2148	RtDCpl64.exe	109
PID 2148 wrote to memory of 1296	2148	RtDCpl64.exe	109
PID 2148 wrote to memory of 1296	2148	RtDCpl64.exe	109
PID 1296 wrote to memory of 4932	1296	RtDCpl64.exe	111
PID 1296 wrote to memory of 4932	1296	RtDCpl64.exe	111
PID 1296 wrote to memory of 4932	1296	RtDCpl64.exe	111
PID 2148 wrote to memory of 4188	2148	RtDCpl64.exe	113
PID 2148 wrote to memory of 4188	2148	RtDCpl64.exe	113
PID 2148 wrote to memory of 4188	2148	RtDCpl64.exe	113
PID 1296 wrote to memory of 4932	1296	RtDCpl64.exe	111
PID 1296 wrote to memory of 4932	1296	RtDCpl64.exe	111
PID 4496 wrote to memory of 4292	4496	RtDCpl64.exe	124
PID 4496 wrote to memory of 4292	4496	RtDCpl64.exe	124
PID 4496 wrote to memory of 4292	4496	RtDCpl64.exe	124
PID 4496 wrote to memory of 1700	4496	RtDCpl64.exe	125
PID 4496 wrote to memory of 1700	4496	RtDCpl64.exe	125
PID 4496 wrote to memory of 1700	4496	RtDCpl64.exe	125
PID 4496 wrote to memory of 1700	4496	RtDCpl64.exe	125
PID 4496 wrote to memory of 1700	4496	RtDCpl64.exe	125
PID 4496 wrote to memory of 3196	4496	RtDCpl64.exe	128
PID 4496 wrote to memory of 3196	4496	RtDCpl64.exe	128
PID 4496 wrote to memory of 3196	4496	RtDCpl64.exe	128

C:\Users\Admin\AppData\Local\Temp\ae38b9a7547fc23847bbb04923a2a4e9.exe
"C:\Users\Admin\AppData\Local\Temp\ae38b9a7547fc23847bbb04923a2a4e9.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
    "C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"
    3⤵
    - Executes dropped EXE
    PID:4688
- C:\Users\Admin\AppData\Local\Temp\ae38b9a7547fc23847bbb04923a2a4e9.exe
  "C:\Users\Admin\AppData\Local\Temp\ae38b9a7547fc23847bbb04923a2a4e9.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:1336
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4720

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:4932
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4188

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
  2⤵
  - Executes dropped EXE
  PID:1700
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:4316
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:3196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Blasthost.exe

Filesize
132KB

MD5
6087bf6af59b9c531f2c9bb421d5e902

SHA1
8bc0f1596c986179b82585c703bacae6d2a00316

SHA256
3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c

SHA512
c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292

Download Submit
C:\Users\Admin\AppData\Roaming\Blasthost.exe

Filesize
92KB

MD5
967da7df52fd805b28b9c9e32273921b

SHA1
c3042ddbcf964eb73f1c78e0895ae9413b0f55c7

SHA256
efbb3ae0e3f973e43455e68cc75a63fde70a0f6833ca7cdeace30e21afd78178

SHA512
f52f443e5f88a8bff1fb14177550f89889ecd380aae40cb0aaac2f327e6ffab5e408e8f8c8ac26f45fb70bcbb7caeb8c046c3793e57f3c98f83669f1e13d0c96

Download Submit
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe

Filesize
35KB

MD5
dc828a9c14b872dedc13d0915c998908

SHA1
5cb799cb7077ab07ae6523a360a89550715e412c

SHA256
da1ec0de78e4a974837de42688a7828d64de8fdcca326ab1d93a34fac7957111

SHA512
e72cda9700096b1b7507addc1926aff542cd810d257b1e559ad5aa54364d5a64ffc3c722397b60608d9e86c8281a0d38a3f8486946ca743b51f69ea475a625ac

Download Submit
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

Filesize
1.3MB

MD5
a21a73c970218476843f589cca8b771d

SHA1
faa54f8fad501b1bb4652061566b9ceea04a1fa8

SHA256
2e5a90edabdaf1356cba9471094080039865f4b8a610f504425d71b6aeeb536d

SHA512
b049018de6f7e995307bad2782a166239b8f021d4cccf20f80ea8034ecf50f412af63de27036fa91b31f88cf208dc68b2e9bfa713d22d2e6379f148c12591b54

Download Submit
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

Filesize
1.2MB

MD5
a857038ee1eae5c94f8b08268d8abd4a

SHA1
c1b2723706ed5fc98caf6da3940e4d7c06b6f029

SHA256
1c221b0044413e926763871d373f60bd30fbf0ec46c87d5e0cccf14920ed34c0

SHA512
04ea25b6d4058410af431d4834693560859dd3a94dfdd28894f1337f96ba977920b2740ad7cf46882cef6a4da630a70eb59661ab0c6ef04051e1a3fd25dad407

Download Submit
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

Filesize
1.3MB

MD5
d5ecab07d95ac0682fd1fbfebcecc9ea

SHA1
c4ce4962d2a63605d061ed18498432de296b4774

SHA256
bd00c29d58622f0f7959cb22d27ea2c79edc2b6c08617a93b58462e5a64e9b55

SHA512
6dbd3c11c53684f9db936867f976527c5b927e3d9829fff55747d7436f5549c9d1c05c435c43ac89ae14acffd9a7156440001cada3f09659c988a025cd4f3c73

Download Submit
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

Filesize
1.2MB

MD5
39ed9f79010b7cfa46ca04ffa0e3e46a

SHA1
85fde6e56210cfc792bf57b008dcab34b78286cd

SHA256
052ee9278665a8932e198c34f64068a3e99c2100c2738c94a29b2ab6e90ab7d7

SHA512
c71859944906a64ee1ee673ee3cd2a4fc725ff45842039048d0cfda971c41619d3b37c7ae04dd31e9ab18a7251ee1249f39b9de3c4d50945d8329ad2a5547619

Download Submit
memory/1336-24-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/2144-75-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2144-52-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4108-22-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4188-8-0x0000000003EC0000-0x0000000003EC1000-memory.dmp

Filesize
4KB

Download
memory/4260-9-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4260-18-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4292-89-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4292-77-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4316-74-0x00000000019F0000-0x00000000019F1000-memory.dmp

Filesize
4KB

Download
memory/4688-27-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4688-26-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4932-47-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads