netwire | 36e46b594095293b8000c5ce676677dd411f61e3212c6fff2549cfc31cc57dbd

Analysis

max time kernel
139s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/02/2024, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
94fd8f7f7d3fa64d123ef55c5f6741d2.exe
Size 305KB
Sample240206-t4t2bsbca7
SHA256 36e46b594095293b8000c5ce676677dd411f61e3212c6fff2549cfc31cc57dbd
MD5 94fd8f7f7d3fa64d123ef55c5f6741d2
SHA1 38c9fa2c4707aa4c355a3b818edd30d1587e3137
SHA512 5ee282b44ad0af6319b90bb59e8d1aad3c8f0290bc98379ab92244f32e1a6514984816664155cc0097c4746b41f72c39a99afd058e5d043aa970ac32ad6708e0
SSDEEP 6144:zHPhCICIBLCTodEEOYchRR5TCwMQLva+StyYKU/WuHl:NGfxnvCwTD5U/WuF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

bright1.awsmppl.com:4770

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/4072-9-0x0000000000140000-0x0000000000170000-memory.dmp	netwire
behavioral2/memory/4072-12-0x0000000000140000-0x0000000000170000-memory.dmp	netwire
behavioral2/memory/4072-17-0x0000000000140000-0x0000000000170000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	94fd8f7f7d3fa64d123ef55c5f6741d2.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pcsllwn.exe.lnk	94fd8f7f7d3fa64d123ef55c5f6741d2.exe

Executes dropped EXE 1 IoCs

pid	Process
4072	svhost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1484 set thread context of 4072	1484	94fd8f7f7d3fa64d123ef55c5f6741d2.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1704	4072	WerFault.exe	84

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\PcHelp\pcsllwn.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1484	94fd8f7f7d3fa64d123ef55c5f6741d2.exe
1484	94fd8f7f7d3fa64d123ef55c5f6741d2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1484	94fd8f7f7d3fa64d123ef55c5f6741d2.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 4072	1484	94fd8f7f7d3fa64d123ef55c5f6741d2.exe	84
PID 1484 wrote to memory of 4072	1484	94fd8f7f7d3fa64d123ef55c5f6741d2.exe	84
PID 1484 wrote to memory of 4072	1484	94fd8f7f7d3fa64d123ef55c5f6741d2.exe	84
PID 1484 wrote to memory of 4072	1484	94fd8f7f7d3fa64d123ef55c5f6741d2.exe	84
PID 1484 wrote to memory of 4072	1484	94fd8f7f7d3fa64d123ef55c5f6741d2.exe	84
PID 1484 wrote to memory of 4072	1484	94fd8f7f7d3fa64d123ef55c5f6741d2.exe	84
PID 1484 wrote to memory of 4072	1484	94fd8f7f7d3fa64d123ef55c5f6741d2.exe	84
PID 1484 wrote to memory of 4072	1484	94fd8f7f7d3fa64d123ef55c5f6741d2.exe	84
PID 1484 wrote to memory of 4072	1484	94fd8f7f7d3fa64d123ef55c5f6741d2.exe	84
PID 1484 wrote to memory of 4072	1484	94fd8f7f7d3fa64d123ef55c5f6741d2.exe	84
PID 1484 wrote to memory of 4364	1484	94fd8f7f7d3fa64d123ef55c5f6741d2.exe	88
PID 1484 wrote to memory of 4364	1484	94fd8f7f7d3fa64d123ef55c5f6741d2.exe	88
PID 1484 wrote to memory of 4364	1484	94fd8f7f7d3fa64d123ef55c5f6741d2.exe	88
PID 1484 wrote to memory of 2312	1484	94fd8f7f7d3fa64d123ef55c5f6741d2.exe	92
PID 1484 wrote to memory of 2312	1484	94fd8f7f7d3fa64d123ef55c5f6741d2.exe	92
PID 1484 wrote to memory of 2312	1484	94fd8f7f7d3fa64d123ef55c5f6741d2.exe	92

C:\Users\Admin\AppData\Local\Temp\94fd8f7f7d3fa64d123ef55c5f6741d2.exe
"C:\Users\Admin\AppData\Local\Temp\94fd8f7f7d3fa64d123ef55c5f6741d2.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  PID:4072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 348
    3⤵
    - Program crash
    PID:1704
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/94fd8f7f7d3fa64d123ef55c5f6741d2.exe" "%temp%\PcHelp\pcsllwn.exe" /Y
  2⤵
  PID:4364
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\PcHelp\pcsllwn.exe:Zone.Identifier
  2⤵
  - NTFS ADS
  PID:2312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4072 -ip 4072
1⤵
PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pcsllwn.exe

Path C:\Users\Admin\AppData\Local\Temp\PcHelp\pcsllwn.exe
Size 305KB
SHA256 36e46b594095293b8000c5ce676677dd411f61e3212c6fff2549cfc31cc57dbd
MD5 94fd8f7f7d3fa64d123ef55c5f6741d2
SHA1 38c9fa2c4707aa4c355a3b818edd30d1587e3137
SHA512 5ee282b44ad0af6319b90bb59e8d1aad3c8f0290bc98379ab92244f32e1a6514984816664155cc0097c4746b41f72c39a99afd058e5d043aa970ac32ad6708e0
SSDEEP 6144:zHPhCICIBLCTodEEOYchRR5TCwMQLva+StyYKU/WuHl:NGfxnvCwTD5U/WuF
MD5 SHA1 SHA512 SSDEEP

Submit Download

svhost.exe

Path C:\Users\Admin\AppData\Local\Temp\svhost.exe
Size 2.5MB
SHA256 c16336ab32195b08c1678220fbe0256fee865f623e2b32fcfa4d9825fd68977e
MD5 0a7608db01cae07792cea95e792aa866
SHA1 71dff876e4d5edb6cea78fee7aa15845d4950e24
SHA512 990a6fa1b8adb6727b1dcd8931ad84fdcb556533b78f896a71eae2a7e3ae3222e4b8efaa4b629ced2841211750e0d8a75ddd546a983c2e586918dd8ba4e0dc42
SSDEEP 49152:S6F5PsH1IaspqACp//9NqqAJN77F29ZJOx2uc:jw16psLqqAJN77F29jOx27
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1484-0-0x0000000074600000-0x0000000074DB0000-memory.dmp

Download

memory/1484-1-0x0000000000BC0000-0x0000000000C12000-memory.dmp

Download

memory/1484-2-0x0000000005600000-0x000000000569C000-memory.dmp

Download

memory/1484-3-0x0000000005720000-0x0000000005730000-memory.dmp

Download

memory/1484-4-0x0000000005590000-0x00000000055BE000-memory.dmp

Download

memory/1484-24-0x0000000074600000-0x0000000074DB0000-memory.dmp

Download

memory/1484-26-0x0000000074600000-0x0000000074DB0000-memory.dmp

Download

memory/4072-9-0x0000000000140000-0x0000000000170000-memory.dmp

Download

memory/4072-12-0x0000000000140000-0x0000000000170000-memory.dmp

Download

memory/4072-17-0x0000000000140000-0x0000000000170000-memory.dmp

Download