netwire | f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b

Analysis

max time kernel
97s
max time network
107s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12-12-2024 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe
Size

584KB
MD5

c9e985c561be0dd05c190dc70ae3518e
SHA1

ffbcb080efbbd36ebb9f81eded9e63c7f66cab9f
SHA256

f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b
SHA512

f1b10f5bc7bb52bf70a8e083a45a823379b1b4e0ca42e7378a07a06d4b3b8346c4dfbc95575534df9b18445eb5d56a6302d07cd86b6017f422d99dccbfec1ebb
SSDEEP

12288:AgIdCFdSZHZVaeSESmqf6G+SqnTrrEsYGre4YzHix:HYYSZ5VrS3xqTrPFr0c

Score

10^/10

netwire botnet discovery persistence rat stealer

Malware Config

Extracted

Family

netwire

38.132.124.156:1199

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
12345
registry_autorun
true
startup_name
ronies
use_mutex
false

Signatures

NetWire RAT payload 6 IoCs

rat

resource	yara_rule
behavioral1/memory/2092-54-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/2092-51-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/2092-56-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/2092-49-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/2092-47-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/2092-45-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Netwire family
netwire

Executes dropped EXE 3 IoCs

pid	Process
1448	service.exe
2828	service.exe
2092	service.exe

Loads dropped DLL 7 IoCs

pid	Process
1172	f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe
1172	f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe
1172	f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe
1172	f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe
1172	f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe
1448	service.exe
1448	service.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\ronies = "C:\\Users\\Admin\\AppData\\Local\\Temp\\service.exe"	service.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1448 set thread context of 2092	1448	service.exe	36

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe

Office loads VBA resources, possible macro or embedded object present

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2880	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2860	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1448	service.exe
1448	service.exe
1448	service.exe
1448	service.exe
1448	service.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2860	WINWORD.EXE
2860	WINWORD.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 1448	1172	f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe	30
PID 1172 wrote to memory of 1448	1172	f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe	30
PID 1172 wrote to memory of 1448	1172	f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe	30
PID 1172 wrote to memory of 1448	1172	f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe	30
PID 1172 wrote to memory of 2860	1172	f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe	31
PID 1172 wrote to memory of 2860	1172	f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe	31
PID 1172 wrote to memory of 2860	1172	f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe	31
PID 1172 wrote to memory of 2860	1172	f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe	31
PID 1448 wrote to memory of 2880	1448	service.exe	32
PID 1448 wrote to memory of 2880	1448	service.exe	32
PID 1448 wrote to memory of 2880	1448	service.exe	32
PID 1448 wrote to memory of 2880	1448	service.exe	32
PID 2860 wrote to memory of 2720	2860	WINWORD.EXE	34
PID 2860 wrote to memory of 2720	2860	WINWORD.EXE	34
PID 2860 wrote to memory of 2720	2860	WINWORD.EXE	34
PID 2860 wrote to memory of 2720	2860	WINWORD.EXE	34
PID 1448 wrote to memory of 2828	1448	service.exe	35
PID 1448 wrote to memory of 2828	1448	service.exe	35
PID 1448 wrote to memory of 2828	1448	service.exe	35
PID 1448 wrote to memory of 2828	1448	service.exe	35
PID 1448 wrote to memory of 2092	1448	service.exe	36
PID 1448 wrote to memory of 2092	1448	service.exe	36
PID 1448 wrote to memory of 2092	1448	service.exe	36
PID 1448 wrote to memory of 2092	1448	service.exe	36
PID 1448 wrote to memory of 2092	1448	service.exe	36
PID 1448 wrote to memory of 2092	1448	service.exe	36
PID 1448 wrote to memory of 2092	1448	service.exe	36
PID 1448 wrote to memory of 2092	1448	service.exe	36
PID 1448 wrote to memory of 2092	1448	service.exe	36
PID 1448 wrote to memory of 2092	1448	service.exe	36
PID 1448 wrote to memory of 2092	1448	service.exe	36
PID 1448 wrote to memory of 2092	1448	service.exe	36

C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe
"C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Users\Admin\AppData\Local\Temp\service.exe
  "C:\Users\Admin\AppData\Local\Temp\service.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HRgFfvmwT" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8150.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2880
- - C:\Users\Admin\AppData\Local\Temp\service.exe
    "C:\Users\Admin\AppData\Local\Temp\service.exe"
    3⤵
    - Executes dropped EXE
    PID:2828
- - C:\Users\Admin\AppData\Local\Temp\service.exe
    "C:\Users\Admin\AppData\Local\Temp\service.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2092
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\CPA accountant COVID_19 pandemic relief (20,000$).docx"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CPA accountant COVID_19 pandemic relief (20,000$).docx

Filesize
68KB

MD5
f5338a212a363459b7354fd8091d5501

SHA1
d5f79a7e7a664147f71dc58988462c51f489e16b

SHA256
9a62f34e8c12aeed7a693399f5d17676c9af7b50865f160fc7eb4d709c252583

SHA512
e033137c54ce92fec4d51f79d2cc79e6d6335060a1ba1f5ad0d30833749034c0c2c750e9cea9b654b1c36ea6cf67adddb08c0c165f46d75530cf7af1c1d81ab0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8150.tmp

Filesize
1KB

MD5
b623a4523edd243bcb0e40e2649c69ea

SHA1
1df1f5234bcecf02a01b8d187cc38b79db61424d

SHA256
f6294a5139f80dd2149bc88252620474d8ff45632edf3f5684ad01339602d4d7

SHA512
ce3000e247fed47db1d0ef9a7b2b3b48e4b34fefa8d8636ef494748435b14c32406e43b31db0e04f08a83d0db348fa95c3696337307cd5ad7d8c5c489bcb522f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\Users\Admin\AppData\Local\Temp\service.exe

Filesize
311KB

MD5
a69b9cf282c900d55cd7452e039daf41

SHA1
0ea752ca500e4b9df336cb4438e7804d3b0186ad

SHA256
3e2526d2955b6709532d1a16a221882619690292dce1527a3399a8d704a4c79d

SHA512
caa067276632186c0ef2e9bf821ad64aff680645a4d0436dac2cefa7aa99feb76cb6a52e672c325ba51783635388f32cd64c2a69f0aa52c1f8f37ab4d29d1765

Download Submit
memory/1448-21-0x0000000073CD1000-0x0000000073CD2000-memory.dmp

Filesize
4KB

Download
memory/1448-22-0x0000000073CD0000-0x000000007427B000-memory.dmp

Filesize
5.7MB

Download
memory/1448-23-0x0000000073CD0000-0x000000007427B000-memory.dmp

Filesize
5.7MB

Download
memory/1448-57-0x0000000073CD0000-0x000000007427B000-memory.dmp

Filesize
5.7MB

Download
memory/2092-47-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-43-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-54-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-53-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2092-51-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-39-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-45-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2860-25-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2860-24-0x000000002FE51000-0x000000002FE52000-memory.dmp

Filesize
4KB

Download