netwire | 4bc227156273b500f6aa709f0c412fac5cc797aef3edbc8a1ed6c0e6b6a65444

General

Target

89088633f3855626d861016cbfbde070N.exe
Size

1.0MB
MD5

89088633f3855626d861016cbfbde070
SHA1

9f7125cd883dcb02b09cc0b4600f94df394ea29a
SHA256

4bc227156273b500f6aa709f0c412fac5cc797aef3edbc8a1ed6c0e6b6a65444
SHA512

7db5fc691805f06b89312a34323e6ea581fcc94214236e673643708a5a5cb540a958e98abad00ef7c9ca288427b116bc1d4e78ce162bbbb51fa8bd401128b9d2
SSDEEP

24576:WAHnh+eWsN3skA4RV1Hom2KXMmHaKHICN34Ls+5OMAs:xh+ZkldoPK8YaKHbZcFJ

Score

10^/10

netwire botnet discovery rat stealer

Malware Config

Extracted

Family

netwire

C2

billions.ddns.net:39780

makebillionaires.warzonedns.com:39360

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Imgburn\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
onelove
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/2920-17-0x00000000000C0000-0x00000000000EC000-memory.dmp	netwire
behavioral1/memory/2920-6-0x00000000000C0000-0x00000000000EC000-memory.dmp	netwire
behavioral1/memory/2168-43-0x0000000000080000-0x00000000000AC000-memory.dmp	netwire
behavioral1/memory/2168-31-0x0000000000080000-0x00000000000AC000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AdaptiveCards.url	89088633f3855626d861016cbfbde070N.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AdaptiveCards.url	Host.exe

Executes dropped EXE 2 IoCs

pid	Process
2128	Host.exe
2168	Host.exe

Loads dropped DLL 2 IoCs

pid	Process
2920	89088633f3855626d861016cbfbde070N.exe
2128	Host.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000b000000012216-19.dat	autoit_exe
behavioral1/files/0x00050000000120e7-25.dat	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1960 set thread context of 2920	1960	89088633f3855626d861016cbfbde070N.exe	30
PID 2128 set thread context of 2168	2128	Host.exe	32
PID 1960 set thread context of 2760	1960	89088633f3855626d861016cbfbde070N.exe	34

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89088633f3855626d861016cbfbde070N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89088633f3855626d861016cbfbde070N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89088633f3855626d861016cbfbde070N.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1960	89088633f3855626d861016cbfbde070N.exe
2128	Host.exe
1960	89088633f3855626d861016cbfbde070N.exe
2128	Host.exe
1960	89088633f3855626d861016cbfbde070N.exe
2128	Host.exe
1960	89088633f3855626d861016cbfbde070N.exe
2128	Host.exe
1960	89088633f3855626d861016cbfbde070N.exe
2128	Host.exe
1960	89088633f3855626d861016cbfbde070N.exe
2128	Host.exe
1960	89088633f3855626d861016cbfbde070N.exe
2128	Host.exe
1960	89088633f3855626d861016cbfbde070N.exe
2128	Host.exe
1960	89088633f3855626d861016cbfbde070N.exe
2128	Host.exe
1960	89088633f3855626d861016cbfbde070N.exe
2128	Host.exe
1960	89088633f3855626d861016cbfbde070N.exe
2128	Host.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1960	89088633f3855626d861016cbfbde070N.exe
1960	89088633f3855626d861016cbfbde070N.exe
1960	89088633f3855626d861016cbfbde070N.exe
2128	Host.exe
2128	Host.exe
2128	Host.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1960	89088633f3855626d861016cbfbde070N.exe
1960	89088633f3855626d861016cbfbde070N.exe
1960	89088633f3855626d861016cbfbde070N.exe
2128	Host.exe
2128	Host.exe
2128	Host.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2920	1960	89088633f3855626d861016cbfbde070N.exe	30
PID 1960 wrote to memory of 2920	1960	89088633f3855626d861016cbfbde070N.exe	30
PID 1960 wrote to memory of 2920	1960	89088633f3855626d861016cbfbde070N.exe	30
PID 1960 wrote to memory of 2920	1960	89088633f3855626d861016cbfbde070N.exe	30
PID 1960 wrote to memory of 2920	1960	89088633f3855626d861016cbfbde070N.exe	30
PID 1960 wrote to memory of 2920	1960	89088633f3855626d861016cbfbde070N.exe	30
PID 2920 wrote to memory of 2128	2920	89088633f3855626d861016cbfbde070N.exe	31
PID 2920 wrote to memory of 2128	2920	89088633f3855626d861016cbfbde070N.exe	31
PID 2920 wrote to memory of 2128	2920	89088633f3855626d861016cbfbde070N.exe	31
PID 2920 wrote to memory of 2128	2920	89088633f3855626d861016cbfbde070N.exe	31
PID 2128 wrote to memory of 2168	2128	Host.exe	32
PID 2128 wrote to memory of 2168	2128	Host.exe	32
PID 2128 wrote to memory of 2168	2128	Host.exe	32
PID 2128 wrote to memory of 2168	2128	Host.exe	32
PID 2128 wrote to memory of 2168	2128	Host.exe	32
PID 2128 wrote to memory of 2168	2128	Host.exe	32
PID 1960 wrote to memory of 2760	1960	89088633f3855626d861016cbfbde070N.exe	34
PID 1960 wrote to memory of 2760	1960	89088633f3855626d861016cbfbde070N.exe	34
PID 1960 wrote to memory of 2760	1960	89088633f3855626d861016cbfbde070N.exe	34
PID 1960 wrote to memory of 2760	1960	89088633f3855626d861016cbfbde070N.exe	34
PID 1960 wrote to memory of 2760	1960	89088633f3855626d861016cbfbde070N.exe	34
PID 1960 wrote to memory of 2760	1960	89088633f3855626d861016cbfbde070N.exe	34

C:\Users\Admin\AppData\Local\Temp\89088633f3855626d861016cbfbde070N.exe
"C:\Users\Admin\AppData\Local\Temp\89088633f3855626d861016cbfbde070N.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\89088633f3855626d861016cbfbde070N.exe
  "C:\Users\Admin\AppData\Local\Temp\89088633f3855626d861016cbfbde070N.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
    "C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
      "C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2168
- C:\Users\Admin\AppData\Local\Temp\89088633f3855626d861016cbfbde070N.exe
  "C:\Users\Admin\AppData\Local\Temp\89088633f3855626d861016cbfbde070N.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AdaptiveCards.vbs

Filesize
113B

MD5
1a30f7e64f76757801d6e0743b872ebf

SHA1
ec073012ffb93c2afba93d6685ba88e4b53641f9

SHA256
2d79aa349400eb07cae4f308f995d63f6ce3324f891bbf0ceadbbf38169111ea

SHA512
31364e7799014007c4f4e38de595e76bf1ea1ce79ff99ff1f3507851e6de68965a375525537b4badc2be9791b571a5ea7b4b933dbcc065414e31de35878d719f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AdaptiveCards.url

Filesize
80B

MD5
1b9bff5c698f8c6cc127bbc89050cbc8

SHA1
dd5b1b066b49108de36f2899d598b8de9bb906c9

SHA256
48de24b95d45475d19ec853376a002498ca380dd2e31f5be4b497eb24a88ea00

SHA512
76de2715113498f889ca451c057d951764234d8ebe65ce5878dc63574fc15c34f8641496eabc9e9a4536be20e78a251523910f9c6bb89503c7481c085554f36e

Download Submit
C:\Users\Admin\AppData\Roaming\onedrive

Filesize
1.0MB

MD5
78a73a1e7a58e11da337e04295cf7dfb

SHA1
c6fd3ea13ae2d890f23e6d7faef76a8502345270

SHA256
eabd70aa808d45fb0ca4d761f5b4be9cfce3f215deec38d9bd322f6e6e484898

SHA512
21aa7b6aa4af943a1bb4269fb0d4e93a33740e4802d7ee7780b066e52ae49cc2192a91fe49a0fd0a3d3a9c8ec226b1b38cd629a2fecac9fdcae22edfcfa8026a

Download Submit
\Users\Admin\AppData\Roaming\Imgburn\Host.exe

Filesize
1.0MB

MD5
89088633f3855626d861016cbfbde070

SHA1
9f7125cd883dcb02b09cc0b4600f94df394ea29a

SHA256
4bc227156273b500f6aa709f0c412fac5cc797aef3edbc8a1ed6c0e6b6a65444

SHA512
7db5fc691805f06b89312a34323e6ea581fcc94214236e673643708a5a5cb540a958e98abad00ef7c9ca288427b116bc1d4e78ce162bbbb51fa8bd401128b9d2

Download Submit
memory/1960-3-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2168-43-0x0000000000080000-0x00000000000AC000-memory.dmp

Filesize
176KB

Download
memory/2168-38-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2168-31-0x0000000000080000-0x00000000000AC000-memory.dmp

Filesize
176KB

Download
memory/2760-53-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2920-6-0x00000000000C0000-0x00000000000EC000-memory.dmp

Filesize
176KB

Download
memory/2920-17-0x00000000000C0000-0x00000000000EC000-memory.dmp

Filesize
176KB

Download
memory/2920-13-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2920-4-0x00000000000C0000-0x00000000000EC000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing