netwire | 3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15

General

Target

3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe
Size

292KB
MD5

a1af186d95ed7de686bd2e59e826f265
SHA1

6a21c0927b2e033af8b3069d76cbac591d0ab530
SHA256

3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15
SHA512

dac79883fda1bb96ff6da725b56edc11be5e266ba1c6e4d4c8e2f84d267df2d2b23b7d0a985491a5285f781f7a347026adc3895bd69eba998421281cb26ee8e3
SSDEEP

6144:VqqDLuq/SIvF68vbpYByPT7lyvIcKeIdT/piE6Hwr9Iv9sBndt:YqnuZIvk8KByPHly5EhhGHU

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

knudandersen.zapto.org:21000

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
07.03.17
keylogger_dir
C:\NVIDIA\profile\
lock_executable
false
offline_keylogger
true
password
1@wi%252ReNd5y0576Z*
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2908-6-0x0000000000400000-0x0000000000449000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.lnk	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2632	2908	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3008	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe
3008	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe
3008	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe
3008	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3008	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2908	3008	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe	28
PID 3008 wrote to memory of 2908	3008	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe	28
PID 3008 wrote to memory of 2908	3008	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe	28
PID 3008 wrote to memory of 2908	3008	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe	28
PID 3008 wrote to memory of 2908	3008	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe	28
PID 3008 wrote to memory of 2908	3008	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe	28
PID 3008 wrote to memory of 2908	3008	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe	28
PID 3008 wrote to memory of 2908	3008	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe	28
PID 3008 wrote to memory of 2908	3008	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe	28
PID 3008 wrote to memory of 2908	3008	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe	28
PID 3008 wrote to memory of 2908	3008	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe	28
PID 3008 wrote to memory of 2908	3008	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe	28
PID 3008 wrote to memory of 2908	3008	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe	28
PID 3008 wrote to memory of 2908	3008	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe	28
PID 3008 wrote to memory of 2908	3008	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe	28
PID 3008 wrote to memory of 2908	3008	3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe	28
PID 2908 wrote to memory of 2632	2908	.exe	29
PID 2908 wrote to memory of 2632	2908	.exe	29
PID 2908 wrote to memory of 2632	2908	.exe	29
PID 2908 wrote to memory of 2632	2908	.exe	29
PID 2908 wrote to memory of 2632	2908	.exe	29
PID 2908 wrote to memory of 2632	2908	.exe	29
PID 2908 wrote to memory of 2632	2908	.exe	29

C:\Users\Admin\AppData\Local\Temp\3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe
"C:\Users\Admin\AppData\Local\Temp\3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Roaming\.exe
  "C:\Users\Admin\AppData\Local\Temp\3d449e44d36e0872c76ff153953a1a65206c83236f208c4be74255e3db73ee15.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 280
    3⤵
    - Program crash
    PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2908-3-0x000000007764F000-0x0000000077650000-memory.dmp

Filesize
4KB

Download
memory/2908-5-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2908-6-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3008-0-0x0000000000360000-0x00000000003DB000-memory.dmp

Filesize
492KB

Download
memory/3008-4-0x0000000000360000-0x00000000003DB000-memory.dmp

Filesize
492KB

Download

Analysis

Sharing