netwire | 9d00cd597fb683332f0754485960fe860d814f855ab634b5b455cf6bc0c32aed

General

Target

58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
Size

112KB
MD5

a7ff8ea9951ceb3e3660bfc3500b211a
SHA1

547237200e4044f1f6e2165b6d9d060adab4ab71
SHA256

58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e
SHA512

f06d47f89ef2cced0d0bc5aa69622ce74b2420b108e6c07ed83be4d93b151eb4025cd5d2005c5f65e1c59a734609eda421c27a55903546a59698ced2b8087d9a
SSDEEP

3072:lh0seFp3R/lmAZCx+Ru8ymVqSSWT78SpeDT2d:lh0s8p373+SNToSpF

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

fartgul.duckdns.org:3360

fartgul.duckdns.org:3369

fartgul.duckdns.org:4000

fratful.dynu.net:4000

fratful.dynu.net:3369

fratful.dynu.net:3360

tartful.hopto.org:3360

tartful.hopto.org:3369

tartful.hopto.org:4000

futerty.mooo.com:3369

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
Pay
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
KcLLFWch
offline_keylogger
true
password
Singlesingle1@
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/2696-7-0x0000000000400000-0x0000000000425000-memory.dmp	netwire
behavioral1/memory/2696-10-0x0000000000400000-0x0000000000425000-memory.dmp	netwire
behavioral1/memory/2696-11-0x0000000000400000-0x0000000000425000-memory.dmp	netwire
behavioral1/memory/2696-12-0x0000000000400000-0x0000000000425000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yVqZv661.url	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yVqZv661.url	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2220 set thread context of 2696	2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe	28

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2696	2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe	28
PID 2220 wrote to memory of 2696	2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe	28
PID 2220 wrote to memory of 2696	2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe	28
PID 2220 wrote to memory of 2696	2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe	28
PID 2220 wrote to memory of 2696	2220	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe	28

C:\Users\Admin\AppData\Local\Temp\58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
"C:\Users\Admin\AppData\Local\Temp\58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
  "C:\Users\Admin\AppData\Local\Temp\58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe"
  2⤵
  PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-0-0x0000000000B70000-0x0000000000B8C000-memory.dmp

Filesize
112KB

Download
memory/2220-1-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download
memory/2220-4-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download
memory/2220-6-0x00000000049C0000-0x0000000004A00000-memory.dmp

Filesize
256KB

Download
memory/2220-8-0x0000000000380000-0x0000000000383000-memory.dmp

Filesize
12KB

Download
memory/2696-7-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2696-10-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2696-11-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2696-12-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing