netwire | 4a36c902a2e841eb72be13a1741e8458[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
4a36c902a2e841eb72be13a1741e8458.bin
Size 746KB
Sample240116-bzb1vaaefp
SHA256 091ac35ca7d8c252bcd036ab6bf5bebd7f21a07e6756c716af0464bc426fc139
MD5 775c27582c25221c8b092a94db48bde6
SHA1 fc0a0dd0ded87688d699f2021c717a18a0e134b3
SHA512 98ee2306c2cc02d31f4fec0673cf026b8ec8f97e8b3203fa3c1f99b9aedb85e200ad5d1f119e9a4543cc6707868ec101543bd71aa3e6874f09aa89a06ef524eb
SSDEEP 12288:C1vkNxQlzX7szB8WDYpS71iv6EZ30q3bIY7CoIao+ytHAgnUyL13K9ZbkCeXWNVT:C5kM499mQqp30E7Ih+yHAg/3K4sT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat netwire

Malware Config

Signatures

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
static1/unpack001/028c26af36b0a9adf4d1a9c91c2531e28580ebd15d2200fec58c81337813ae56.exe	netwire

Netwire family
netwire

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack001/028c26af36b0a9adf4d1a9c91c2531e28580ebd15d2200fec58c81337813ae56.exe	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/028c26af36b0a9adf4d1a9c91c2531e28580ebd15d2200fec58c81337813ae56.exe

File Explorer

4a36c902a2e841eb72be13a1741e8458.bin

.zip 746KB
028c26af36b0a9adf4d1a9c91c2531e28580ebd15d2200fec58c81337813ae56.exe

.exe 1.3MB

4a36c902a2e841eb72be13a1741e8458.bin

SHA256 091ac35ca7d8c252bcd036ab6bf5bebd7f21a07e6756c716af0464bc426fc139
MD5 775c27582c25221c8b092a94db48bde6
SHA1 fc0a0dd0ded87688d699f2021c717a18a0e134b3
SHA512 98ee2306c2cc02d31f4fec0673cf026b8ec8f97e8b3203fa3c1f99b9aedb85e200ad5d1f119e9a4543cc6707868ec101543bd71aa3e6874f09aa89a06ef524eb
SSDEEP 12288:C1vkNxQlzX7szB8WDYpS71iv6EZ30q3bIY7CoIao+ytHAgnUyL13K9ZbkCeXWNVT:C5kM499mQqp30E7Ih+yHAg/3K4sT
MD5 SHA1 SHA512 SSDEEP

Password

infected

028c26af36b0a9adf4d1a9c91c2531e28580ebd15d2200fec58c81337813ae56.exe

IMPHASH eb97e4fc5518ac300a92a11673825e0b
SHA256 028c26af36b0a9adf4d1a9c91c2531e28580ebd15d2200fec58c81337813ae56
MD5 4a36c902a2e841eb72be13a1741e8458
SHA1 ad7d071afddbba4c7ea60f79936b498ad32cd9f9
SHA512 74463a507f53772252061516bdde6cc02450332ba0b24f12f99007eef92457296eb8eb13ecc61baa6410041bab334ae87ee8cbcb80ecb2b1147e86a7f49d38e7
SSDEEP 24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWY/:8u0c++OCvkGs9Fa+rd1f26RaY/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NetWire RAT payload

rat
AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

163277

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

WSACleanup socket inet_ntoa setsockopt ntohs recvfrom ioctlsocket htons WSAStartup __WSAFDIsSet select accept listen bind closesocket WSAGetLastError recv sendto send inet_addr gethostbyname gethostname connect

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

winmm

timeGetTime waveOutSetVolume mciSendStringW

comctl32

ImageList_ReplaceIcon ImageList_Destroy ImageList_Remove ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ImageList_DragMove InitCommonControlsEx ImageList_Create

mpr

WNetUseConnectionW WNetCancelConnection2W WNetGetConnectionW WNetAddConnection2W

wininet

InternetQueryDataAvailable InternetCloseHandle InternetOpenW InternetSetOptionW InternetCrackUrlW HttpQueryInfoW InternetQueryOptionW HttpOpenRequestW HttpSendRequestW FtpOpenFileW FtpGetFileSize InternetOpenUrlW InternetReadFile InternetConnectW

psapi

GetProcessMemoryInfo

iphlpapi

IcmpCreateFile IcmpCloseHandle IcmpSendEcho

userenv

DestroyEnvironmentBlock UnloadUserProfile CreateEnvironmentBlock LoadUserProfileW

uxtheme

IsThemeActive

kernel32

DuplicateHandle CreateThread WaitForSingleObject HeapAlloc GetProcessHeap HeapFree Sleep GetCurrentThreadId MultiByteToWideChar MulDiv GetVersionExW IsWow64Process GetSystemInfo FreeLibrary LoadLibraryA GetProcAddress SetErrorMode GetModuleFileNameW WideCharToMultiByte lstrcpyW lstrlenW GetModuleHandleW QueryPerformanceCounter VirtualFreeEx OpenProcess VirtualAllocEx WriteProcessMemory ReadProcessMemory CreateFileW SetFilePointerEx SetEndOfFile ReadFile WriteFile FlushFileBuffers TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileTime GetFileAttributesW FindFirstFileW SetCurrentDirectoryW GetLongPathNameW GetShortPathNameW DeleteFileW FindNextFileW CopyFileExW MoveFileW CreateDirectoryW RemoveDirectoryW SetSystemPowerState QueryPerformanceFrequency FindResourceW LoadResource LockResource SizeofResource EnumResourceNamesW OutputDebugStringW GetTempPathW GetTempFileNameW DeviceIoControl GetLocalTime CompareStringW GetCurrentProcess EnterCriticalSection LeaveCriticalSection GetStdHandle CreatePipe InterlockedExchange TerminateThread LoadLibraryExW FindResourceExW CopyFileW VirtualFree FormatMessageW GetExitCodeProcess GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetDriveTypeW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetVolumeInformationW SetVolumeLabelW CreateHardLinkW SetFileAttributesW CreateEventW SetEvent GetEnvironmentVariableW SetEnvironmentVariableW GlobalLock GlobalUnlock GlobalAlloc GetFileSize GlobalFree GlobalMemoryStatusEx Beep GetSystemDirectoryW HeapReAlloc HeapSize GetComputerNameW GetWindowsDirectoryW GetCurrentProcessId GetProcessIoCounters CreateProcessW GetProcessId SetPriorityClass LoadLibraryW VirtualAlloc IsDebuggerPresent GetCurrentDirectoryW lstrcmpiW DecodePointer GetLastError RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedDecrement InterlockedIncrement GetCurrentThread CloseHandle GetFullPathNameW EncodePointer ExitProcess GetModuleHandleExW ExitThread GetSystemTimeAsFileTime ResumeThread GetCommandLineW IsProcessorFeaturePresent IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetStringTypeW SetStdHandle GetFileType GetConsoleCP GetConsoleMode RtlUnwind ReadConsoleW GetTimeZoneInformation GetDateFormatW GetTimeFormatW LCMapStringW GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW FindClose SetEnvironmentVariableA

user32

AdjustWindowRectEx CopyImage SetWindowPos GetCursorInfo RegisterHotKey ClientToScreen GetKeyboardLayoutNameW IsCharAlphaW IsCharAlphaNumericW IsCharLowerW IsCharUpperW GetMenuStringW GetSubMenu GetCaretPos IsZoomed MonitorFromPoint GetMonitorInfoW SetWindowLongW SetLayeredWindowAttributes FlashWindow GetClassLongW TranslateAcceleratorW IsDialogMessageW GetSysColor InflateRect DrawFocusRect DrawTextW FrameRect DrawFrameControl FillRect PtInRect DestroyAcceleratorTable CreateAcceleratorTableW SetCursor GetWindowDC GetSystemMetrics GetActiveWindow CharNextW wsprintfW RedrawWindow DrawMenuBar DestroyMenu SetMenu GetWindowTextLengthW CreateMenu IsDlgButtonChecked DefDlgProcW CallWindowProcW ReleaseCapture SetCapture CreateIconFromResourceEx mouse_event ExitWindowsEx SetActiveWindow FindWindowExW EnumThreadWindows SetMenuDefaultItem InsertMenuItemW IsMenu TrackPopupMenuEx GetCursorPos DeleteMenu SetRect GetMenuItemID GetMenuItemCount SetMenuItemInfoW GetMenuItemInfoW SetForegroundWindow IsIconic FindWindowW MonitorFromRect keybd_event SendInput GetAsyncKeyState SetKeyboardState GetKeyboardState GetKeyState VkKeyScanW LoadStringW DialogBoxParamW MessageBeep EndDialog SendDlgItemMessageW GetDlgItem SetWindowTextW CopyRect ReleaseDC GetDC EndPaint BeginPaint GetClientRect GetMenu DestroyWindow EnumWindows GetDesktopWindow IsWindow IsWindowEnabled IsWindowVisible EnableWindow InvalidateRect GetWindowLongW GetWindowThreadProcessId AttachThreadInput GetFocus GetWindowTextW ScreenToClient SendMessageTimeoutW EnumChildWindows CharUpperBuffW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW PostMessageW GetWindowRect SetUserObjectSecurity CloseDesktop CloseWindowStation OpenDesktopW SetProcessWindowStation GetProcessWindowStation OpenWindowStationW GetUserObjectSecurity MessageBoxW DefWindowProcW SetClipboardData EmptyClipboard CountClipboardFormats CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard BlockInput GetMessageW LockWindowUpdate DispatchMessageW TranslateMessage PeekMessageW UnregisterHotKey CheckMenuRadioItem CharLowerBuffW MoveWindow SetFocus PostQuitMessage KillTimer CreatePopupMenu RegisterWindowMessageW SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW GetSysColorBrush GetForegroundWindow MessageBoxA DestroyIcon SystemParametersInfoW LoadImageW GetClassNameW

gdi32

StrokePath DeleteObject GetTextExtentPoint32W ExtCreatePen GetDeviceCaps EndPath SetPixel CloseFigure CreateCompatibleBitmap CreateCompatibleDC SelectObject StretchBlt GetDIBits LineTo AngleArc MoveToEx Ellipse DeleteDC GetPixel CreateDCW GetStockObject GetTextFaceW CreateFontW SetTextColor PolyDraw BeginPath Rectangle SetViewportOrgEx GetObjectW SetBkMode RoundRect SetBkColor CreatePen CreateSolidBrush StrokeAndFillPath

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

GetAce RegEnumValueW RegDeleteValueW RegDeleteKeyW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegConnectRegistryW InitializeSecurityDescriptor InitializeAcl AdjustTokenPrivileges OpenThreadToken OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx CreateProcessAsUserW CreateProcessWithLogonW GetLengthSid CopySid LogonUserW AllocateAndInitializeSid CheckTokenMembership RegCreateKeyExW FreeSid GetTokenInformation GetSecurityDescriptorDacl GetAclInformation AddAce SetSecurityDescriptorDacl GetUserNameW InitiateSystemShutdownExW

shell32

DragQueryPoint ShellExecuteExW DragQueryFileW SHEmptyRecycleBinW SHGetPathFromIDListW SHBrowseForFolderW SHCreateShellItem SHGetDesktopFolder SHGetSpecialFolderLocation SHGetFolderPathW SHFileOperationW ExtractIconExW Shell_NotifyIconW ShellExecuteW DragFinish

ole32

CoTaskMemAlloc CoTaskMemFree CLSIDFromString ProgIDFromCLSID CLSIDFromProgID OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject CoCreateInstance IIDFromString StringFromGUID2 CreateStreamOnHGlobal OleInitialize OleUninitialize CoInitialize CoUninitialize GetRunningObjectTable CoGetInstanceFromFile CoGetObject CoSetProxyBlanket CoCreateInstanceEx CoInitializeSecurity

oleaut32

LoadTypeLibEx VariantCopyInd SysReAllocString SysFreeString SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayUnaccessData SafeArrayAccessData SafeArrayAllocData SafeArrayAllocDescriptorEx SafeArrayCreateVector RegisterTypeLi CreateStdDispatch DispCallFunc VariantChangeType SysStringLen VariantTimeToSystemTime VarR8FromDec SafeArrayGetVartype VariantCopy VariantClear OleLoadPicture QueryPathOfRegTypeLi RegisterTypeLibForUser UnRegisterTypeLibForUser UnRegisterTypeLi CreateDispTypeInfo SysAllocString VariantInit