netwire | c7e06f4529c5b7713ce51085a19c975324911c3d5100f107a806028c62c05387

Analysis

max time kernel
154s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ae38b9a7547fc23847bbb04923a2a4e9.exe
Size 1.3MB
Sample240111-vr1tsadbe3
SHA256 c7e06f4529c5b7713ce51085a19c975324911c3d5100f107a806028c62c05387
MD5 ae38b9a7547fc23847bbb04923a2a4e9
SHA1 d63feb534ed6d4bf31f2c7603eb0d79980a2e52f
SHA512 62a5b00fc860874b26883ff8d5724a4d429f34062b3667356f6dcf97d9390a2bb15e3ae0c3adad80e03984357d92af921bdaf8b0d53497f29b6f7ae93f26e687
SSDEEP 24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWYx:8u0c++OCvkGs9Fa+rd1f26RaYx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

netwire warzonerat botnet infostealer rat stealer

Malware Config

Extracted

Family

netwire

Wealthy2019.com.strangled.net:20190
wealthyme.ddns.net:20190

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
sunshineslisa
install_path
%AppData%\Imgburn\Host.exe
keylogger_dir
%AppData%\Logs\Imgburn\
lock_executable
false
offline_keylogger
true
password
sucess
registry_autorun
false
use_mutex
false

Extracted

Family

warzonerat

wealth.warzonedns.com:5202

Signatures

NetWire RAT payload 14 IoCs

rat

resource	yara_rule
behavioral2/files/0x0008000000023155-4.dat	netwire
behavioral2/files/0x0008000000023155-7.dat	netwire
behavioral2/memory/4108-22-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/files/0x000800000002316c-20.dat	netwire
behavioral2/memory/4688-26-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/4688-27-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/files/0x0008000000023178-28.dat	netwire
behavioral2/files/0x0008000000023178-29.dat	netwire
behavioral2/files/0x0008000000023178-45.dat	netwire
behavioral2/memory/2144-52-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/files/0x0008000000023178-61.dat	netwire
behavioral2/memory/2144-75-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/4292-77-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/4292-89-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/4260-9-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/4260-18-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	ae38b9a7547fc23847bbb04923a2a4e9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	RtDCpl64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	RtDCpl64.exe

Executes dropped EXE 8 IoCs

pid	Process
4108	Blasthost.exe
4688	Host.exe
2148	RtDCpl64.exe
2144	Blasthost.exe
1296	RtDCpl64.exe
4496	RtDCpl64.exe
4292	Blasthost.exe
1700	RtDCpl64.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0008000000023178-28.dat	autoit_exe
behavioral2/files/0x0008000000023178-29.dat	autoit_exe
behavioral2/files/0x0008000000023178-45.dat	autoit_exe
behavioral2/files/0x0008000000023178-61.dat	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4188 set thread context of 4260	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	93
PID 2148 set thread context of 1296	2148	RtDCpl64.exe	109
PID 4496 set thread context of 1700	4496	RtDCpl64.exe	125

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4720	schtasks.exe
4188	schtasks.exe
3196	schtasks.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 4108	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	91
PID 4188 wrote to memory of 4108	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	91
PID 4188 wrote to memory of 4108	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	91
PID 4188 wrote to memory of 4260	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	93
PID 4188 wrote to memory of 4260	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	93
PID 4188 wrote to memory of 4260	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	93
PID 4188 wrote to memory of 4260	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	93
PID 4188 wrote to memory of 4260	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	93
PID 4108 wrote to memory of 4688	4108	Blasthost.exe	98
PID 4108 wrote to memory of 4688	4108	Blasthost.exe	98
PID 4108 wrote to memory of 4688	4108	Blasthost.exe	98
PID 4260 wrote to memory of 1336	4260	ae38b9a7547fc23847bbb04923a2a4e9.exe	95
PID 4260 wrote to memory of 1336	4260	ae38b9a7547fc23847bbb04923a2a4e9.exe	95
PID 4260 wrote to memory of 1336	4260	ae38b9a7547fc23847bbb04923a2a4e9.exe	95
PID 4188 wrote to memory of 4720	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	97
PID 4188 wrote to memory of 4720	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	97
PID 4188 wrote to memory of 4720	4188	ae38b9a7547fc23847bbb04923a2a4e9.exe	97
PID 4260 wrote to memory of 1336	4260	ae38b9a7547fc23847bbb04923a2a4e9.exe	95
PID 4260 wrote to memory of 1336	4260	ae38b9a7547fc23847bbb04923a2a4e9.exe	95
PID 2148 wrote to memory of 2144	2148	RtDCpl64.exe	108
PID 2148 wrote to memory of 2144	2148	RtDCpl64.exe	108
PID 2148 wrote to memory of 2144	2148	RtDCpl64.exe	108
PID 2148 wrote to memory of 1296	2148	RtDCpl64.exe	109
PID 2148 wrote to memory of 1296	2148	RtDCpl64.exe	109
PID 2148 wrote to memory of 1296	2148	RtDCpl64.exe	109
PID 2148 wrote to memory of 1296	2148	RtDCpl64.exe	109
PID 2148 wrote to memory of 1296	2148	RtDCpl64.exe	109
PID 1296 wrote to memory of 4932	1296	RtDCpl64.exe	111
PID 1296 wrote to memory of 4932	1296	RtDCpl64.exe	111
PID 1296 wrote to memory of 4932	1296	RtDCpl64.exe	111
PID 2148 wrote to memory of 4188	2148	RtDCpl64.exe	113
PID 2148 wrote to memory of 4188	2148	RtDCpl64.exe	113
PID 2148 wrote to memory of 4188	2148	RtDCpl64.exe	113
PID 1296 wrote to memory of 4932	1296	RtDCpl64.exe	111
PID 1296 wrote to memory of 4932	1296	RtDCpl64.exe	111
PID 4496 wrote to memory of 4292	4496	RtDCpl64.exe	124
PID 4496 wrote to memory of 4292	4496	RtDCpl64.exe	124
PID 4496 wrote to memory of 4292	4496	RtDCpl64.exe	124
PID 4496 wrote to memory of 1700	4496	RtDCpl64.exe	125
PID 4496 wrote to memory of 1700	4496	RtDCpl64.exe	125
PID 4496 wrote to memory of 1700	4496	RtDCpl64.exe	125
PID 4496 wrote to memory of 1700	4496	RtDCpl64.exe	125
PID 4496 wrote to memory of 1700	4496	RtDCpl64.exe	125
PID 4496 wrote to memory of 3196	4496	RtDCpl64.exe	128
PID 4496 wrote to memory of 3196	4496	RtDCpl64.exe	128
PID 4496 wrote to memory of 3196	4496	RtDCpl64.exe	128

C:\Users\Admin\AppData\Local\Temp\ae38b9a7547fc23847bbb04923a2a4e9.exe
"C:\Users\Admin\AppData\Local\Temp\ae38b9a7547fc23847bbb04923a2a4e9.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
    "C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"
    3⤵
    - Executes dropped EXE
    PID:4688
- C:\Users\Admin\AppData\Local\Temp\ae38b9a7547fc23847bbb04923a2a4e9.exe
  "C:\Users\Admin\AppData\Local\Temp\ae38b9a7547fc23847bbb04923a2a4e9.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:1336
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4720

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:4932
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4188

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
  2⤵
  - Executes dropped EXE
  PID:1700
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:4316
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:3196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Blasthost.exe

Path C:\Users\Admin\AppData\Roaming\Blasthost.exe
Size 132KB
SHA256 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c
MD5 6087bf6af59b9c531f2c9bb421d5e902
SHA1 8bc0f1596c986179b82585c703bacae6d2a00316
SHA512 c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292
SSDEEP 1536:dtTSUSKzF0Lh9a7WraTWFbmDHVXWRVAzZ8MfUSl7Q3rwc5ggZG:dt5SKzF0Lh9a7IGW9GHeOFVvc3rvZG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Blasthost.exe

Path C:\Users\Admin\AppData\Roaming\Blasthost.exe
Size 92KB
SHA256 efbb3ae0e3f973e43455e68cc75a63fde70a0f6833ca7cdeace30e21afd78178
MD5 967da7df52fd805b28b9c9e32273921b
SHA1 c3042ddbcf964eb73f1c78e0895ae9413b0f55c7
SHA512 f52f443e5f88a8bff1fb14177550f89889ecd380aae40cb0aaac2f327e6ffab5e408e8f8c8ac26f45fb70bcbb7caeb8c046c3793e57f3c98f83669f1e13d0c96
SSDEEP 1536:dtTSUSKzF0Lh9a7WraTWFbmDHVXWRVAzZ8/:dt5SKzF0Lh9a7IGW9GHeOFo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Host.exe

Path C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
Size 35KB
SHA256 da1ec0de78e4a974837de42688a7828d64de8fdcca326ab1d93a34fac7957111
MD5 dc828a9c14b872dedc13d0915c998908
SHA1 5cb799cb7077ab07ae6523a360a89550715e412c
SHA512 e72cda9700096b1b7507addc1926aff542cd810d257b1e559ad5aa54364d5a64ffc3c722397b60608d9e86c8281a0d38a3f8486946ca743b51f69ea475a625ac
SSDEEP 384:73EMYv6rF9X1qg6b+rCSKtxZtE4FcPv8vsS0HCZm54ASKzi+NuLh9fpfPllToJf8:4MXDJem44EkSsXSKzF0Lh9FA11ep
MD5 SHA1 SHA512 SSDEEP

Submit Download

RtDCpl64.exe

Path C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
Size 1.3MB
SHA256 2e5a90edabdaf1356cba9471094080039865f4b8a610f504425d71b6aeeb536d
MD5 a21a73c970218476843f589cca8b771d
SHA1 faa54f8fad501b1bb4652061566b9ceea04a1fa8
SHA512 b049018de6f7e995307bad2782a166239b8f021d4cccf20f80ea8034ecf50f412af63de27036fa91b31f88cf208dc68b2e9bfa713d22d2e6379f148c12591b54
SSDEEP 24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWYW:8u0c++OCvkGs9Fa+rd1f26RaYW
MD5 SHA1 SHA512 SSDEEP

Submit Download

RtDCpl64.exe

Path C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
Size 1.2MB
SHA256 1c221b0044413e926763871d373f60bd30fbf0ec46c87d5e0cccf14920ed34c0
MD5 a857038ee1eae5c94f8b08268d8abd4a
SHA1 c1b2723706ed5fc98caf6da3940e4d7c06b6f029
SHA512 04ea25b6d4058410af431d4834693560859dd3a94dfdd28894f1337f96ba977920b2740ad7cf46882cef6a4da630a70eb59661ab0c6ef04051e1a3fd25dad407
SSDEEP 24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5Rr:8u0c++OCvkGs9Fa+rd1f26r
MD5 SHA1 SHA512 SSDEEP

Submit Download

RtDCpl64.exe

Path C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
Size 1.3MB
SHA256 bd00c29d58622f0f7959cb22d27ea2c79edc2b6c08617a93b58462e5a64e9b55
MD5 d5ecab07d95ac0682fd1fbfebcecc9ea
SHA1 c4ce4962d2a63605d061ed18498432de296b4774
SHA512 6dbd3c11c53684f9db936867f976527c5b927e3d9829fff55747d7436f5549c9d1c05c435c43ac89ae14acffd9a7156440001cada3f09659c988a025cd4f3c73
SSDEEP 24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWYC:8u0c++OCvkGs9Fa+rd1f26RaYC
MD5 SHA1 SHA512 SSDEEP

Submit Download

RtDCpl64.exe

Path C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
Size 1.2MB
SHA256 052ee9278665a8932e198c34f64068a3e99c2100c2738c94a29b2ab6e90ab7d7
MD5 39ed9f79010b7cfa46ca04ffa0e3e46a
SHA1 85fde6e56210cfc792bf57b008dcab34b78286cd
SHA512 c71859944906a64ee1ee673ee3cd2a4fc725ff45842039048d0cfda971c41619d3b37c7ae04dd31e9ab18a7251ee1249f39b9de3c4d50945d8329ad2a5547619
SSDEEP 24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1s:8u0c++OCvkGs9Fa+rd1s
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1336-24-0x0000000000B60000-0x0000000000B61000-memory.dmp

Download

memory/2144-75-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2144-52-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4108-22-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4188-8-0x0000000003EC0000-0x0000000003EC1000-memory.dmp

Download

memory/4260-9-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4260-18-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4292-89-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4292-77-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4316-74-0x00000000019F0000-0x00000000019F1000-memory.dmp

Download

memory/4688-27-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4688-26-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4932-47-0x0000000000700000-0x0000000000701000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads