netwire | 079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe
Size 1.3MB
Sample240319-vy6cvaac41
SHA256 079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834
MD5 9ac6f538378fef047242692a5fc1dab5
SHA1 e88a7bcea3fda912befbf62d215b919620fab13c
SHA512 68bc25c7528377f4c39ee05d20efc135d5c7ec15694a3b780ccde56fc2f8eaf05c35898174dc899dee4a82c964a94b9047e54c4561032c2ac6f9edd8cd4545ab
SSDEEP 24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWYZ:8u0c++OCvkGs9Fa+rd1f26RaYZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

netwire warzonerat botnet infostealer rat stealer

Malware Config

Extracted

Family

netwire

Wealthy2019.com.strangled.net:20190
wealthyme.ddns.net:20190

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
sunshineslisa
install_path
%AppData%\Imgburn\Host.exe
keylogger_dir
%AppData%\Logs\Imgburn\
lock_executable
false
offline_keylogger
true
password
sucess
registry_autorun
false
use_mutex
false

Extracted

Family

warzonerat

wealth.warzonedns.com:5202

Signatures

NetWire RAT payload 10 IoCs

rat

resource	yara_rule
behavioral2/files/0x000c00000002312e-4.dat	netwire
behavioral2/memory/8-10-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/files/0x00070000000231eb-26.dat	netwire
behavioral2/memory/2124-48-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/4796-49-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/2124-54-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/4704-76-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/4704-84-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/4796-87-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/files/0x00070000000231eb-100.dat	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/4892-13-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/4892-22-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/964-92-0x0000000000420000-0x000000000043D000-memory.dmp	warzonerat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	RtDCpl64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	RtDCpl64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	RtDCpl64.exe

Executes dropped EXE 11 IoCs

pid	Process
8	Blasthost.exe
2124	Host.exe
1216	RtDCpl64.exe
4796	Blasthost.exe
2908	RtDCpl64.exe
3708	RtDCpl64.exe
4704	Blasthost.exe
5076	RtDCpl64.exe
4072	RtDCpl64.exe
3236	Blasthost.exe
964	RtDCpl64.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x00070000000231eb-26.dat	autoit_exe
behavioral2/files/0x00070000000231eb-100.dat	autoit_exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3532 set thread context of 4892	3532	079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe	95
PID 1216 set thread context of 2908	1216	RtDCpl64.exe	103
PID 3708 set thread context of 5076	3708	RtDCpl64.exe	122
PID 4072 set thread context of 964	4072	RtDCpl64.exe	135

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3816	schtasks.exe
4592	schtasks.exe
884	schtasks.exe
1584	schtasks.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 8	3532	079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe	92
PID 3532 wrote to memory of 8	3532	079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe	92
PID 3532 wrote to memory of 8	3532	079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe	92
PID 8 wrote to memory of 2124	8	Blasthost.exe	94
PID 8 wrote to memory of 2124	8	Blasthost.exe	94
PID 8 wrote to memory of 2124	8	Blasthost.exe	94
PID 3532 wrote to memory of 4892	3532	079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe	95
PID 3532 wrote to memory of 4892	3532	079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe	95
PID 3532 wrote to memory of 4892	3532	079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe	95
PID 3532 wrote to memory of 4892	3532	079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe	95
PID 3532 wrote to memory of 4892	3532	079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe	95
PID 4892 wrote to memory of 3920	4892	079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe	96
PID 4892 wrote to memory of 3920	4892	079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe	96
PID 4892 wrote to memory of 3920	4892	079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe	96
PID 3532 wrote to memory of 884	3532	079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe	98
PID 3532 wrote to memory of 884	3532	079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe	98
PID 3532 wrote to memory of 884	3532	079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe	98
PID 4892 wrote to memory of 3920	4892	079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe	96
PID 4892 wrote to memory of 3920	4892	079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe	96
PID 1216 wrote to memory of 4796	1216	RtDCpl64.exe	102
PID 1216 wrote to memory of 4796	1216	RtDCpl64.exe	102
PID 1216 wrote to memory of 4796	1216	RtDCpl64.exe	102
PID 1216 wrote to memory of 2908	1216	RtDCpl64.exe	103
PID 1216 wrote to memory of 2908	1216	RtDCpl64.exe	103
PID 1216 wrote to memory of 2908	1216	RtDCpl64.exe	103
PID 1216 wrote to memory of 2908	1216	RtDCpl64.exe	103
PID 1216 wrote to memory of 2908	1216	RtDCpl64.exe	103
PID 2908 wrote to memory of 4280	2908	RtDCpl64.exe	104
PID 2908 wrote to memory of 4280	2908	RtDCpl64.exe	104
PID 2908 wrote to memory of 4280	2908	RtDCpl64.exe	104
PID 1216 wrote to memory of 1584	1216	RtDCpl64.exe	106
PID 1216 wrote to memory of 1584	1216	RtDCpl64.exe	106
PID 1216 wrote to memory of 1584	1216	RtDCpl64.exe	106
PID 2908 wrote to memory of 4280	2908	RtDCpl64.exe	104
PID 2908 wrote to memory of 4280	2908	RtDCpl64.exe	104
PID 3708 wrote to memory of 4704	3708	RtDCpl64.exe	121
PID 3708 wrote to memory of 4704	3708	RtDCpl64.exe	121
PID 3708 wrote to memory of 4704	3708	RtDCpl64.exe	121
PID 3708 wrote to memory of 5076	3708	RtDCpl64.exe	122
PID 3708 wrote to memory of 5076	3708	RtDCpl64.exe	122
PID 3708 wrote to memory of 5076	3708	RtDCpl64.exe	122
PID 3708 wrote to memory of 5076	3708	RtDCpl64.exe	122
PID 3708 wrote to memory of 5076	3708	RtDCpl64.exe	122
PID 5076 wrote to memory of 4256	5076	RtDCpl64.exe	123
PID 5076 wrote to memory of 4256	5076	RtDCpl64.exe	123
PID 5076 wrote to memory of 4256	5076	RtDCpl64.exe	123
PID 3708 wrote to memory of 3816	3708	RtDCpl64.exe	125
PID 3708 wrote to memory of 3816	3708	RtDCpl64.exe	125
PID 3708 wrote to memory of 3816	3708	RtDCpl64.exe	125
PID 5076 wrote to memory of 4256	5076	RtDCpl64.exe	123
PID 5076 wrote to memory of 4256	5076	RtDCpl64.exe	123
PID 4072 wrote to memory of 3236	4072	RtDCpl64.exe	134
PID 4072 wrote to memory of 3236	4072	RtDCpl64.exe	134
PID 4072 wrote to memory of 3236	4072	RtDCpl64.exe	134
PID 4072 wrote to memory of 964	4072	RtDCpl64.exe	135
PID 4072 wrote to memory of 964	4072	RtDCpl64.exe	135
PID 4072 wrote to memory of 964	4072	RtDCpl64.exe	135
PID 4072 wrote to memory of 964	4072	RtDCpl64.exe	135
PID 4072 wrote to memory of 964	4072	RtDCpl64.exe	135
PID 964 wrote to memory of 2684	964	RtDCpl64.exe	136
PID 964 wrote to memory of 2684	964	RtDCpl64.exe	136
PID 964 wrote to memory of 2684	964	RtDCpl64.exe	136
PID 4072 wrote to memory of 4592	4072	RtDCpl64.exe	138
PID 4072 wrote to memory of 4592	4072	RtDCpl64.exe	138

C:\Users\Admin\AppData\Local\Temp\079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe
"C:\Users\Admin\AppData\Local\Temp\079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
    "C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"
    3⤵
    - Executes dropped EXE
    PID:2124
- C:\Users\Admin\AppData\Local\Temp\079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe
  "C:\Users\Admin\AppData\Local\Temp\079a5231d54b93c39eff8c49b414dd536de0bbb9ea56687173ac8b2bc00d1834.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:3920
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:884

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:4280
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1584

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:4256
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:3816

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:2684
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Blasthost.exe

Path C:\Users\Admin\AppData\Roaming\Blasthost.exe
Size 132KB
SHA256 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c
MD5 6087bf6af59b9c531f2c9bb421d5e902
SHA1 8bc0f1596c986179b82585c703bacae6d2a00316
SHA512 c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292
SSDEEP 1536:dtTSUSKzF0Lh9a7WraTWFbmDHVXWRVAzZ8MfUSl7Q3rwc5ggZG:dt5SKzF0Lh9a7IGW9GHeOFVvc3rvZG
MD5 SHA1 SHA512 SSDEEP

Submit Download

RtDCpl64.exe

Path C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
Size 192KB
SHA256 05cf7b003358733956db1bf0633cfa323f80265805150c2b56b29e65d33931ed
MD5 a5d0bec051326930600b4e0915764035
SHA1 305b803d217c153f362ba659e433c1a7f4fbd36d
SHA512 324eff61f9ac5e4752e62bc0f9cacea0064377631327d318b63874b768c4177362d991533da46ca588d060071b19471abb387a99289718520f19efdb9eb168a9
SSDEEP 3072:KvA56nsfyBgm9JnK+Q0iZ//BqkaJXweJz3/DdDl1KPbDFY8:KY56s0LKBRcX1dD7r8
MD5 SHA1 SHA512 SSDEEP

Submit Download

RtDCpl64.exe

Path C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
Size 1.3MB
SHA256 a56b8585305d23d4a4efe2f40b2c5ce4b03fdc39e09f92f460bcdc98214b54e2
MD5 0540c992485171910288415f84642e39
SHA1 c70266803a097d4612841c4eb5cfda089df06ec6
SHA512 3ab34bbc736034ebae98a4f77cb1a33880942c98462071edda3342ab2ccb84f08104d93da2c4482668bada456ce27465d40f5412cd76c19c37bedf9144072b98
SSDEEP 24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWYP:8u0c++OCvkGs9Fa+rd1f26RaYP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-10-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/964-92-0x0000000000420000-0x000000000043D000-memory.dmp

Download

memory/2124-48-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2124-54-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3532-16-0x0000000002160000-0x0000000002161000-memory.dmp

Download

memory/3920-24-0x00000000007B0000-0x00000000007B1000-memory.dmp

Download

memory/4072-104-0x0000000001350000-0x0000000001351000-memory.dmp

Download

memory/4256-71-0x00000000010F0000-0x00000000010F1000-memory.dmp

Download

memory/4280-45-0x00000000014E0000-0x00000000014E1000-memory.dmp

Download

memory/4704-76-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4704-84-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4796-87-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4796-49-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4892-22-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4892-13-0x0000000000400000-0x000000000041D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads