netwire | cdf8b484121e8b872db86fc75be27073a0d1be264e5f106d890d6f9bba69d16a

General

Target

1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
Size

1.1MB
MD5

9c6d1aca02db373a52401485c376d87e
SHA1

9cc4435729a11d7c524d761b67de508b4474b206
SHA256

1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06
SHA512

9f4aaadf939a97e2354f18ef1943594edf2c6eb04852e4fecc68ff1eeee9146ff1ec1ac26191f8c9435e39b765da23f14aa835313de670d3235e6b4eb890955d
SSDEEP

24576:iCdxte/80jYLT3U1jfsWa/69ryeoEuGfYsoRzDQ:zw80cTsjkWa/FR4

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

halwachi50.mymediapc.net:5868

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
true
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/1752-1-0x0000000000770000-0x000000000079C000-memory.dmp	netwire
behavioral2/memory/1752-10-0x0000000000770000-0x000000000079C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Executes dropped EXE 1 IoCs

pid	Process
3708	Host.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000300000000070f-13.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3516 set thread context of 1752	3516	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe	104

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3516	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
3516	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
3516	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
3516	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
3708	Host.exe
3708	Host.exe
3708	Host.exe
3708	Host.exe
3708	Host.exe
3708	Host.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3516	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
3516	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
3516	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
3708	Host.exe
3708	Host.exe
3708	Host.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
3516	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
3516	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
3516	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
3708	Host.exe
3708	Host.exe
3708	Host.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 1752	3516	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe	104
PID 3516 wrote to memory of 1752	3516	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe	104
PID 3516 wrote to memory of 1752	3516	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe	104
PID 3516 wrote to memory of 1752	3516	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe	104
PID 3516 wrote to memory of 1752	3516	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe	104
PID 1752 wrote to memory of 3708	1752	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe	105
PID 1752 wrote to memory of 3708	1752	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe	105
PID 1752 wrote to memory of 3708	1752	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe	105

C:\Users\Admin\AppData\Local\Temp\1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
"C:\Users\Admin\AppData\Local\Temp\1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Users\Admin\AppData\Local\Temp\1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
  "C:\Users\Admin\AppData\Local\Temp\1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Users\Admin\AppData\Roaming\Install\Host.exe
    "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:4824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
1.1MB

MD5
9c6d1aca02db373a52401485c376d87e

SHA1
9cc4435729a11d7c524d761b67de508b4474b206

SHA256
1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06

SHA512
9f4aaadf939a97e2354f18ef1943594edf2c6eb04852e4fecc68ff1eeee9146ff1ec1ac26191f8c9435e39b765da23f14aa835313de670d3235e6b4eb890955d

Download Submit
memory/1752-1-0x0000000000770000-0x000000000079C000-memory.dmp

Filesize
176KB

Download
memory/1752-10-0x0000000000770000-0x000000000079C000-memory.dmp

Filesize
176KB

Download
memory/3516-0-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing