netwire | d087e164df89fa39f7357aa16ac4e4e1ab7abfb698993422bba4f6741815e1f5

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d8046f1e6a03e67c41249746b22d180_NEIKI.exe
Size

1.3MB
MD5

0d8046f1e6a03e67c41249746b22d180
SHA1

4f751229fda60523975e73c7df7a22d21405dabe
SHA256

d087e164df89fa39f7357aa16ac4e4e1ab7abfb698993422bba4f6741815e1f5
SHA512

76099d52042f980274a5e708fb9bc9591825a53ad9eb7657e4c1b54acf3cc6b2c3c84b886f2370821219e0515691edb124f43eda944b76a8ee3015254ea159f3
SSDEEP

24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWY/:8u0c++OCvkGs9Fa+rd1f26RaY/

Score

10^/10

netwire warzonerat botnet infostealer rat stealer

Malware Config

Extracted

Family

netwire

Wealthy2019.com.strangled.net:20190

wealthyme.ddns.net:20190

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
sunshineslisa
install_path
%AppData%\Imgburn\Host.exe
keylogger_dir
%AppData%\Logs\Imgburn\
lock_executable
false
offline_keylogger
true
password
sucess
registry_autorun
false
use_mutex
false

Extracted

Family

warzonerat

wealth.warzonedns.com:5202

Signatures

NetWire RAT payload 5 IoCs

rat

resource	yara_rule
behavioral1/files/0x000b000000015a2d-2.dat	netwire
behavioral1/memory/2908-23-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/files/0x0007000000015cb9-46.dat	netwire
behavioral1/memory/2512-81-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/2636-82-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/2716-27-0x0000000000080000-0x000000000009D000-memory.dmp	warzonerat
behavioral1/memory/2716-38-0x0000000000080000-0x000000000009D000-memory.dmp	warzonerat

Executes dropped EXE 11 IoCs

pid	Process
2908	Blasthost.exe
2512	Host.exe
2392	RtDCpl64.exe
2636	Blasthost.exe
1016	RtDCpl64.exe
676	RtDCpl64.exe
568	Blasthost.exe
2172	RtDCpl64.exe
1696	RtDCpl64.exe
2004	Blasthost.exe
1600	RtDCpl64.exe

Loads dropped DLL 16 IoCs

pid	Process
1808	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe
1808	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe
1808	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe
1808	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe
2908	Blasthost.exe
2908	Blasthost.exe
2392	RtDCpl64.exe
2392	RtDCpl64.exe
2392	RtDCpl64.exe
2392	RtDCpl64.exe
676	RtDCpl64.exe
676	RtDCpl64.exe
676	RtDCpl64.exe
1696	RtDCpl64.exe
1696	RtDCpl64.exe
1696	RtDCpl64.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0007000000015cb9-46.dat	autoit_exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1808 set thread context of 2716	1808	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe	30
PID 2392 set thread context of 1016	2392	RtDCpl64.exe	38
PID 676 set thread context of 2172	676	RtDCpl64.exe	47
PID 1696 set thread context of 1600	1696	RtDCpl64.exe	54

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2592	schtasks.exe
836	schtasks.exe
436	schtasks.exe
3016	schtasks.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2908	1808	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe	28
PID 1808 wrote to memory of 2908	1808	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe	28
PID 1808 wrote to memory of 2908	1808	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe	28
PID 1808 wrote to memory of 2908	1808	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe	28
PID 2908 wrote to memory of 2512	2908	Blasthost.exe	29
PID 2908 wrote to memory of 2512	2908	Blasthost.exe	29
PID 2908 wrote to memory of 2512	2908	Blasthost.exe	29
PID 2908 wrote to memory of 2512	2908	Blasthost.exe	29
PID 1808 wrote to memory of 2716	1808	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe	30
PID 1808 wrote to memory of 2716	1808	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe	30
PID 1808 wrote to memory of 2716	1808	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe	30
PID 1808 wrote to memory of 2716	1808	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe	30
PID 1808 wrote to memory of 2716	1808	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe	30
PID 1808 wrote to memory of 2716	1808	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe	30
PID 2716 wrote to memory of 2640	2716	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe	31
PID 2716 wrote to memory of 2640	2716	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe	31
PID 2716 wrote to memory of 2640	2716	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe	31
PID 2716 wrote to memory of 2640	2716	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe	31
PID 1808 wrote to memory of 2592	1808	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe	33
PID 1808 wrote to memory of 2592	1808	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe	33
PID 1808 wrote to memory of 2592	1808	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe	33
PID 1808 wrote to memory of 2592	1808	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe	33
PID 2716 wrote to memory of 2640	2716	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe	31
PID 2716 wrote to memory of 2640	2716	0d8046f1e6a03e67c41249746b22d180_NEIKI.exe	31
PID 2632 wrote to memory of 2392	2632	taskeng.exe	36
PID 2632 wrote to memory of 2392	2632	taskeng.exe	36
PID 2632 wrote to memory of 2392	2632	taskeng.exe	36
PID 2632 wrote to memory of 2392	2632	taskeng.exe	36
PID 2392 wrote to memory of 2636	2392	RtDCpl64.exe	37
PID 2392 wrote to memory of 2636	2392	RtDCpl64.exe	37
PID 2392 wrote to memory of 2636	2392	RtDCpl64.exe	37
PID 2392 wrote to memory of 2636	2392	RtDCpl64.exe	37
PID 2392 wrote to memory of 1016	2392	RtDCpl64.exe	38
PID 2392 wrote to memory of 1016	2392	RtDCpl64.exe	38
PID 2392 wrote to memory of 1016	2392	RtDCpl64.exe	38
PID 2392 wrote to memory of 1016	2392	RtDCpl64.exe	38
PID 2392 wrote to memory of 1016	2392	RtDCpl64.exe	38
PID 2392 wrote to memory of 1016	2392	RtDCpl64.exe	38
PID 1016 wrote to memory of 844	1016	RtDCpl64.exe	39
PID 1016 wrote to memory of 844	1016	RtDCpl64.exe	39
PID 1016 wrote to memory of 844	1016	RtDCpl64.exe	39
PID 1016 wrote to memory of 844	1016	RtDCpl64.exe	39
PID 2392 wrote to memory of 836	2392	RtDCpl64.exe	41
PID 2392 wrote to memory of 836	2392	RtDCpl64.exe	41
PID 2392 wrote to memory of 836	2392	RtDCpl64.exe	41
PID 2392 wrote to memory of 836	2392	RtDCpl64.exe	41
PID 1016 wrote to memory of 844	1016	RtDCpl64.exe	39
PID 1016 wrote to memory of 844	1016	RtDCpl64.exe	39
PID 2632 wrote to memory of 676	2632	taskeng.exe	45
PID 2632 wrote to memory of 676	2632	taskeng.exe	45
PID 2632 wrote to memory of 676	2632	taskeng.exe	45
PID 2632 wrote to memory of 676	2632	taskeng.exe	45
PID 676 wrote to memory of 568	676	RtDCpl64.exe	46
PID 676 wrote to memory of 568	676	RtDCpl64.exe	46
PID 676 wrote to memory of 568	676	RtDCpl64.exe	46
PID 676 wrote to memory of 568	676	RtDCpl64.exe	46
PID 676 wrote to memory of 2172	676	RtDCpl64.exe	47
PID 676 wrote to memory of 2172	676	RtDCpl64.exe	47
PID 676 wrote to memory of 2172	676	RtDCpl64.exe	47
PID 676 wrote to memory of 2172	676	RtDCpl64.exe	47
PID 676 wrote to memory of 2172	676	RtDCpl64.exe	47
PID 676 wrote to memory of 2172	676	RtDCpl64.exe	47
PID 2172 wrote to memory of 1060	2172	RtDCpl64.exe	48
PID 2172 wrote to memory of 1060	2172	RtDCpl64.exe	48

C:\Users\Admin\AppData\Local\Temp\0d8046f1e6a03e67c41249746b22d180_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\0d8046f1e6a03e67c41249746b22d180_NEIKI.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
    "C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"
    3⤵
    - Executes dropped EXE
    PID:2512
- C:\Users\Admin\AppData\Local\Temp\0d8046f1e6a03e67c41249746b22d180_NEIKI.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8046f1e6a03e67c41249746b22d180_NEIKI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:2640
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:2592

C:\Windows\system32\taskeng.exe
taskeng.exe {6494064D-41D5-4A06-A564-9ECA20CCDD9F} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Users\Admin\AppData\Roaming\Blasthost.exe
    "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
    3⤵
    - Executes dropped EXE
    PID:2636
- - C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
    "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1016
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:844
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
    3⤵
    - Creates scheduled task(s)
    PID:836
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Users\Admin\AppData\Roaming\Blasthost.exe
    "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
    3⤵
    - Executes dropped EXE
    PID:568
- - C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
    "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:1060
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
    3⤵
    - Creates scheduled task(s)
    PID:436
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  PID:1696
- - C:\Users\Admin\AppData\Roaming\Blasthost.exe
    "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
    3⤵
    - Executes dropped EXE
    PID:2004
- - C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
    "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
    3⤵
    - Executes dropped EXE
    PID:1600
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:2984
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
    3⤵
    - Creates scheduled task(s)
    PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

Filesize
1.3MB

MD5
e4294e558bfe6b01ca5e6c30abc0e062

SHA1
a709c180f8c31204a2a9c6f76a1315e801e46cce

SHA256
e44bd18364848f6e8d81c0e2722c2eab23e406f0284e2bfa4ad08e854c261ff1

SHA512
45a8564645d9272bf57ba75e493dcd46e873403e8c8175b9c00c1205b20c571bf99c368125b69eef08c6658004435ab86d7dc3b76dcca2a832173a9c5e35b875

Download Submit
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

Filesize
448KB

MD5
376fa06e4592a8f7060a1cb1794d13dd

SHA1
1c12394a7acd9cb952baf666b46a9f3f7548059f

SHA256
7e8faf500b284459fed94b39209fdf6e50ced69646f55d68dfca006fec945fce

SHA512
7c357bc0ecc0b8163cc07b8a6b79a7270edf629cd7300f11605069a2761160cca620647362758ac672469c19a4b1eefaf0af9421fe11b92236f489986aba9e0d

Download Submit
\Users\Admin\AppData\Roaming\Blasthost.exe

Filesize
132KB

MD5
6087bf6af59b9c531f2c9bb421d5e902

SHA1
8bc0f1596c986179b82585c703bacae6d2a00316

SHA256
3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c

SHA512
c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292

Download Submit
memory/844-77-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1016-71-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1060-111-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/1808-37-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/2512-81-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2636-82-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2640-40-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2640-42-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2716-25-0x0000000000080000-0x000000000009D000-memory.dmp

Filesize
116KB

Download
memory/2716-34-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2716-38-0x0000000000080000-0x000000000009D000-memory.dmp

Filesize
116KB

Download
memory/2716-27-0x0000000000080000-0x000000000009D000-memory.dmp

Filesize
116KB

Download
memory/2908-23-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads