netwire | 9d00cd597fb683332f0754485960fe860d814f855ab634b5b455cf6bc0c32aed

General

Target

58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
Size

112KB
MD5

a7ff8ea9951ceb3e3660bfc3500b211a
SHA1

547237200e4044f1f6e2165b6d9d060adab4ab71
SHA256

58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e
SHA512

f06d47f89ef2cced0d0bc5aa69622ce74b2420b108e6c07ed83be4d93b151eb4025cd5d2005c5f65e1c59a734609eda421c27a55903546a59698ced2b8087d9a
SSDEEP

3072:lh0seFp3R/lmAZCx+Ru8ymVqSSWT78SpeDT2d:lh0s8p373+SNToSpF

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

fartgul.duckdns.org:3360

fartgul.duckdns.org:3369

fartgul.duckdns.org:4000

fratful.dynu.net:4000

fratful.dynu.net:3369

fratful.dynu.net:3360

tartful.hopto.org:3360

tartful.hopto.org:3369

tartful.hopto.org:4000

futerty.mooo.com:3369

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
Pay
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
KcLLFWch
offline_keylogger
true
password
Singlesingle1@
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2596-8-0x0000000000400000-0x0000000000425000-memory.dmp	netwire
behavioral1/memory/2596-10-0x0000000000400000-0x0000000000425000-memory.dmp	netwire
behavioral1/memory/2596-12-0x0000000000400000-0x0000000000425000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Drops startup file 2 IoCs

Processes:

58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yVqZv661.url	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yVqZv661.url	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe

description	pid	process	target process
PID 1612 set thread context of 2596	1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe

pid	process
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe

pid process

1612 58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe

description pid process

Token: SeDebugPrivilege 1612 58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe

description	pid	process
Token: SeDebugPrivilege	1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe

description	pid	process	target process
PID 1612 wrote to memory of 2596	1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
PID 1612 wrote to memory of 2596	1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
PID 1612 wrote to memory of 2596	1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
PID 1612 wrote to memory of 2596	1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
PID 1612 wrote to memory of 2596	1612	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe	58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe

C:\Users\Admin\AppData\Local\Temp\58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
"C:\Users\Admin\AppData\Local\Temp\58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612

C:\Users\Admin\AppData\Local\Temp\58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe
"C:\Users\Admin\AppData\Local\Temp\58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e.exe"
2⤵
PID:2596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-0-0x00000000010D0000-0x00000000010EC000-memory.dmp

Filesize
112KB

Download
memory/1612-1-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/1612-3-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/1612-6-0x0000000001040000-0x0000000001080000-memory.dmp

Filesize
256KB

Download
memory/1612-7-0x0000000000300000-0x0000000000303000-memory.dmp

Filesize
12KB

Download
memory/1612-11-0x0000000001040000-0x0000000001080000-memory.dmp

Filesize
256KB

Download
memory/2596-8-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2596-10-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2596-12-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads