netwire | f4e0f4719e1913eb95dbceb89fd0fe40eb566a03382aa32f920fe1cfa44fde95

General

Target

68127baac5cc72ffe0cd709fe766b29b.exe
Size

225KB
MD5

68127baac5cc72ffe0cd709fe766b29b
SHA1

9c687b6a50db829a86bce661215ba2f236f715c3
SHA256

f4e0f4719e1913eb95dbceb89fd0fe40eb566a03382aa32f920fe1cfa44fde95
SHA512

dacd8b815a6c4660ec57e458a52c6603f134e34acf84d15d4e2bb8402e32a8696dc3c9f0a8c2c6a53f442fef076d1b8749f9f4af29d70f04cf11d740d4eb9ac9
SSDEEP

6144:akzo7MV7dhBSSf6Ho9pLjkdJipW7EcorkQy:akMYVB9CIX+eRr

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

vegan.giize.com:1604

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
lock_executable
false
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 6 IoCs

rat

resource	yara_rule
behavioral1/memory/2508-18-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/2508-20-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/2508-22-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/2508-24-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/2508-28-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/2508-31-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UyieKdoeUeirUsy.exe	pOwERsHeLl.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UyieKdoeUeirUsy.exe	pOwERsHeLl.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2212 set thread context of 2508	2212	68127baac5cc72ffe0cd709fe766b29b.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	2508	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2780	pOwERsHeLl.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	pOwERsHeLl.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2780	2212	68127baac5cc72ffe0cd709fe766b29b.exe	28
PID 2212 wrote to memory of 2780	2212	68127baac5cc72ffe0cd709fe766b29b.exe	28
PID 2212 wrote to memory of 2780	2212	68127baac5cc72ffe0cd709fe766b29b.exe	28
PID 2212 wrote to memory of 2780	2212	68127baac5cc72ffe0cd709fe766b29b.exe	28
PID 2212 wrote to memory of 2508	2212	68127baac5cc72ffe0cd709fe766b29b.exe	30
PID 2212 wrote to memory of 2508	2212	68127baac5cc72ffe0cd709fe766b29b.exe	30
PID 2212 wrote to memory of 2508	2212	68127baac5cc72ffe0cd709fe766b29b.exe	30
PID 2212 wrote to memory of 2508	2212	68127baac5cc72ffe0cd709fe766b29b.exe	30
PID 2212 wrote to memory of 2508	2212	68127baac5cc72ffe0cd709fe766b29b.exe	30
PID 2212 wrote to memory of 2508	2212	68127baac5cc72ffe0cd709fe766b29b.exe	30
PID 2212 wrote to memory of 2508	2212	68127baac5cc72ffe0cd709fe766b29b.exe	30
PID 2212 wrote to memory of 2508	2212	68127baac5cc72ffe0cd709fe766b29b.exe	30
PID 2212 wrote to memory of 2508	2212	68127baac5cc72ffe0cd709fe766b29b.exe	30
PID 2212 wrote to memory of 2508	2212	68127baac5cc72ffe0cd709fe766b29b.exe	30
PID 2212 wrote to memory of 2508	2212	68127baac5cc72ffe0cd709fe766b29b.exe	30
PID 2212 wrote to memory of 2508	2212	68127baac5cc72ffe0cd709fe766b29b.exe	30
PID 2212 wrote to memory of 2508	2212	68127baac5cc72ffe0cd709fe766b29b.exe	30
PID 2212 wrote to memory of 2508	2212	68127baac5cc72ffe0cd709fe766b29b.exe	30
PID 2212 wrote to memory of 2508	2212	68127baac5cc72ffe0cd709fe766b29b.exe	30
PID 2508 wrote to memory of 3056	2508	InstallUtil.exe	31
PID 2508 wrote to memory of 3056	2508	InstallUtil.exe	31
PID 2508 wrote to memory of 3056	2508	InstallUtil.exe	31
PID 2508 wrote to memory of 3056	2508	InstallUtil.exe	31

C:\Users\Admin\AppData\Local\Temp\68127baac5cc72ffe0cd709fe766b29b.exe
"C:\Users\Admin\AppData\Local\Temp\68127baac5cc72ffe0cd709fe766b29b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pOwERsHeLl.exe
  "pOwERsHeLl.exe" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\68127baac5cc72ffe0cd709fe766b29b.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UyieKdoeUeirUsy.exe'
  2⤵
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 140
    3⤵
    - Program crash
    PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-13-0x0000000000340000-0x0000000000354000-memory.dmp

Filesize
80KB

Download
memory/2212-1-0x0000000074DA0000-0x000000007548E000-memory.dmp

Filesize
6.9MB

Download
memory/2212-2-0x0000000004880000-0x00000000048C0000-memory.dmp

Filesize
256KB

Download
memory/2212-3-0x0000000000410000-0x000000000044C000-memory.dmp

Filesize
240KB

Download
memory/2212-4-0x0000000074DA0000-0x000000007548E000-memory.dmp

Filesize
6.9MB

Download
memory/2212-5-0x0000000004880000-0x00000000048C0000-memory.dmp

Filesize
256KB

Download
memory/2212-30-0x0000000074DA0000-0x000000007548E000-memory.dmp

Filesize
6.9MB

Download
memory/2212-0-0x0000000000160000-0x000000000019E000-memory.dmp

Filesize
248KB

Download
memory/2508-22-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2508-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2508-31-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2508-14-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2508-28-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2508-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2508-18-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2508-20-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2508-15-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2508-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2780-9-0x00000000715F0000-0x0000000071B9B000-memory.dmp

Filesize
5.7MB

Download
memory/2780-12-0x00000000715F0000-0x0000000071B9B000-memory.dmp

Filesize
5.7MB

Download
memory/2780-8-0x00000000715F0000-0x0000000071B9B000-memory.dmp

Filesize
5.7MB

Download
memory/2780-10-0x00000000025B0000-0x00000000025F0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing