netwire | 282e441b58eed38ce5b5aeae04ad6d174ff23b8c7a6ced664c54b683f8cfc8ab

General

Target

66ae237c1680a6c0194d4a5ef883a146.exe
Size

1.5MB
MD5

66ae237c1680a6c0194d4a5ef883a146
SHA1

7c37067d047caae8b5ca9127a6b89845e833c520
SHA256

282e441b58eed38ce5b5aeae04ad6d174ff23b8c7a6ced664c54b683f8cfc8ab
SHA512

894d8f621a240f99bf9914c2efe2205b61cedf16573a559020616e26dc47f8cdf9fc4f063ed8a1b46e6ca51baa4f5cda317d60aa3649f0af90abdbc88ddca5a0
SSDEEP

24576:AAOcZwdf+OD0+5PYjasPw5X1WelwB1rABQ8iHX0eFpPFbKi6FGxGIsDCabnd:ef5wja2ayfmgpPFbKi6kxxK1bnd

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

harold.ns01.info:3606

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
Netwir
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
pHJVBoFH
offline_keylogger
true
password
master12
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/3744-78-0x0000000000FC0000-0x000000000166E000-memory.dmp	netwire
behavioral2/memory/3744-80-0x0000000000FC0000-0x000000000166E000-memory.dmp	netwire
behavioral2/memory/3744-81-0x0000000000FC0000-0x000000000166E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	66ae237c1680a6c0194d4a5ef883a146.exe

Executes dropped EXE 1 IoCs

pid	Process
2260	lqilwl.pif

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\40791675\\lqilwl.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\40791675\\wmrvmdcs.ije"	lqilwl.pif

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2260 set thread context of 3744	2260	lqilwl.pif	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2260	2568	66ae237c1680a6c0194d4a5ef883a146.exe	93
PID 2568 wrote to memory of 2260	2568	66ae237c1680a6c0194d4a5ef883a146.exe	93
PID 2568 wrote to memory of 2260	2568	66ae237c1680a6c0194d4a5ef883a146.exe	93
PID 2260 wrote to memory of 3744	2260	lqilwl.pif	97
PID 2260 wrote to memory of 3744	2260	lqilwl.pif	97
PID 2260 wrote to memory of 3744	2260	lqilwl.pif	97
PID 2260 wrote to memory of 3744	2260	lqilwl.pif	97
PID 2260 wrote to memory of 3744	2260	lqilwl.pif	97

C:\Users\Admin\AppData\Local\Temp\66ae237c1680a6c0194d4a5ef883a146.exe
"C:\Users\Admin\AppData\Local\Temp\66ae237c1680a6c0194d4a5ef883a146.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Users\Admin\AppData\Local\Temp\40791675\lqilwl.pif
  "C:\Users\Admin\AppData\Local\Temp\40791675\lqilwl.pif" wmrvmdcs.ije
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:3744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\40791675\lqilwl.pif

Filesize
649KB

MD5
e423fa6f72ef1a0d63ef5f85380657d6

SHA1
83114ec1db55867fde6d249352fcb3c52ef53af2

SHA256
4c38d6dc99e8219ccc923bddc94c9298f6b5aee6b4b42323d924cffdeafd356e

SHA512
687407a6354547f11faf190472e5fa5c50c0d01d911823b372d80029054e2e830c08b2a9100f5f1b1a742d0755bddfb784854bd7431f98b6b352010e2d01dac3

Download Submit
C:\Users\Admin\AppData\Local\Temp\40791675\mird.xml

Filesize
377KB

MD5
744295ad3e845c00badb2c4701521e8b

SHA1
039c5c54de34eb8a8fbb29d8ba0912d355e1293f

SHA256
b8cc7d152ee42023207babb9ea6511fea1565b7e5a4f43bbeb27d3f028c1e4c0

SHA512
1236d0dd7078064e7c4a1fe88e8696b53bef794fe754878c2d362a2ef418facbb5e386076912905ce611f6d12d9a95c0a20f4a8b699a3e412be5729a59f8362e

Download Submit
C:\Users\Admin\AppData\Local\Temp\40791675\wmrvmdcs.ije

Filesize
3.4MB

MD5
1c38813983f0695cd45db98df24bac6b

SHA1
878182cceb1d4458c6bd9a483f3c3cdf975235a5

SHA256
a5082da9268ad63ceffe0d5ccd9cca049e582601be91cbe3aea5a9a89188e6e1

SHA512
3c7e2928edb1c1a4efb3135190196f5aed32978a88d3d8e3402ac791aa693b3dd70ba9704a68072602fdb1b18a5d92b8cd20cd4822c6389f7699f46c1252e3f0

Download Submit
memory/3744-78-0x0000000000FC0000-0x000000000166E000-memory.dmp

Filesize
6.7MB

Download
memory/3744-80-0x0000000000FC0000-0x000000000166E000-memory.dmp

Filesize
6.7MB

Download
memory/3744-81-0x0000000000FC0000-0x000000000166E000-memory.dmp

Filesize
6.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads