netwire | 96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe
Size

1.3MB
MD5

1863d6289847354313f0be30ebb3f510
SHA1

ec64a087fcb26bf31a244d1954177614d270d453
SHA256

96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2
SHA512

6c633467be7d217b3b8b83756e4cf8e1d55d0fa3cf3f403360aa1bfe21e70e56dc3f01dd698ed0797a230d03d9e860750d76807761ad459810dd270e11e47b90
SSDEEP

24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWYF:8u0c++OCvkGs9Fa+rd1f26RaYF

Score

10^/10

netwire warzonerat botnet infostealer rat stealer

Malware Config

Extracted

Family

netwire

Wealthy2019.com.strangled.net:20190

wealthyme.ddns.net:20190

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
sunshineslisa
install_path
%AppData%\Imgburn\Host.exe
keylogger_dir
%AppData%\Logs\Imgburn\
lock_executable
false
offline_keylogger
true
password
sucess
registry_autorun
false
use_mutex
false

Extracted

Family

warzonerat

wealth.warzonedns.com:5202

Signatures

NetWire RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Blasthost.exe	netwire
behavioral1/memory/1088-23-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/2924-45-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe	netwire
behavioral1/memory/2560-85-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/2924-90-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzone RAT payload 2 IoCs
rat

Processes:

resource yara_rule

behavioral1/memory/2840-28-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat
behavioral1/memory/2840-38-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat
Executes dropped EXE 8 IoCs

Processes:

Blasthost.exeHost.exeRtDCpl64.exeBlasthost.exeRtDCpl64.exeRtDCpl64.exeBlasthost.exeRtDCpl64.exe

pid process

1088 Blasthost.exe
2924 Host.exe
2412 RtDCpl64.exe
2560 Blasthost.exe
2020 RtDCpl64.exe
1188 RtDCpl64.exe
1064 Blasthost.exe
1320 RtDCpl64.exe

resource	yara_rule
behavioral1/memory/2840-28-0x0000000000080000-0x000000000009D000-memory.dmp	warzonerat
behavioral1/memory/2840-38-0x0000000000080000-0x000000000009D000-memory.dmp	warzonerat

pid	process
1088	Blasthost.exe
2924	Host.exe
2412	RtDCpl64.exe
2560	Blasthost.exe
2020	RtDCpl64.exe
1188	RtDCpl64.exe
1064	Blasthost.exe
1320	RtDCpl64.exe

Loads dropped DLL 13 IoCs

Processes:

96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exeBlasthost.exeRtDCpl64.exeRtDCpl64.exe

pid	process
3040	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe
3040	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe
3040	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe
3040	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe
1088	Blasthost.exe
1088	Blasthost.exe
2412	RtDCpl64.exe
2412	RtDCpl64.exe
2412	RtDCpl64.exe
2412	RtDCpl64.exe
1188	RtDCpl64.exe
1188	RtDCpl64.exe
1188	RtDCpl64.exe

AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.

Processes:

resource yara_rule

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe autoit_exe

resource	yara_rule
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exeRtDCpl64.exeRtDCpl64.exe

description	pid	process	target process
PID 3040 set thread context of 2840	3040	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe
PID 2412 set thread context of 2020	2412	RtDCpl64.exe	RtDCpl64.exe
PID 1188 set thread context of 1320	1188	RtDCpl64.exe	RtDCpl64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

2784 schtasks.exe
1740 schtasks.exe
1876 schtasks.exe

pid	process
2784	schtasks.exe
1740	schtasks.exe
1876	schtasks.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exeBlasthost.exe96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exetaskeng.exeRtDCpl64.exeRtDCpl64.exeRtDCpl64.exe

description	pid	process	target process
PID 3040 wrote to memory of 1088	3040	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe	Blasthost.exe
PID 3040 wrote to memory of 1088	3040	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe	Blasthost.exe
PID 3040 wrote to memory of 1088	3040	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe	Blasthost.exe
PID 3040 wrote to memory of 1088	3040	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe	Blasthost.exe
PID 1088 wrote to memory of 2924	1088	Blasthost.exe	Host.exe
PID 1088 wrote to memory of 2924	1088	Blasthost.exe	Host.exe
PID 1088 wrote to memory of 2924	1088	Blasthost.exe	Host.exe
PID 1088 wrote to memory of 2924	1088	Blasthost.exe	Host.exe
PID 3040 wrote to memory of 2840	3040	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe
PID 3040 wrote to memory of 2840	3040	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe
PID 3040 wrote to memory of 2840	3040	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe
PID 3040 wrote to memory of 2840	3040	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe
PID 3040 wrote to memory of 2840	3040	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe
PID 3040 wrote to memory of 2840	3040	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe
PID 3040 wrote to memory of 2784	3040	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe	schtasks.exe
PID 3040 wrote to memory of 2784	3040	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe	schtasks.exe
PID 3040 wrote to memory of 2784	3040	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe	schtasks.exe
PID 3040 wrote to memory of 2784	3040	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe	schtasks.exe
PID 2840 wrote to memory of 2732	2840	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe	cmd.exe
PID 2840 wrote to memory of 2732	2840	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe	cmd.exe
PID 2840 wrote to memory of 2732	2840	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe	cmd.exe
PID 2840 wrote to memory of 2732	2840	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe	cmd.exe
PID 2840 wrote to memory of 2732	2840	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe	cmd.exe
PID 2840 wrote to memory of 2732	2840	96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe	cmd.exe
PID 2660 wrote to memory of 2412	2660	taskeng.exe	RtDCpl64.exe
PID 2660 wrote to memory of 2412	2660	taskeng.exe	RtDCpl64.exe
PID 2660 wrote to memory of 2412	2660	taskeng.exe	RtDCpl64.exe
PID 2660 wrote to memory of 2412	2660	taskeng.exe	RtDCpl64.exe
PID 2412 wrote to memory of 2560	2412	RtDCpl64.exe	Blasthost.exe
PID 2412 wrote to memory of 2560	2412	RtDCpl64.exe	Blasthost.exe
PID 2412 wrote to memory of 2560	2412	RtDCpl64.exe	Blasthost.exe
PID 2412 wrote to memory of 2560	2412	RtDCpl64.exe	Blasthost.exe
PID 2412 wrote to memory of 2020	2412	RtDCpl64.exe	RtDCpl64.exe
PID 2412 wrote to memory of 2020	2412	RtDCpl64.exe	RtDCpl64.exe
PID 2412 wrote to memory of 2020	2412	RtDCpl64.exe	RtDCpl64.exe
PID 2412 wrote to memory of 2020	2412	RtDCpl64.exe	RtDCpl64.exe
PID 2412 wrote to memory of 2020	2412	RtDCpl64.exe	RtDCpl64.exe
PID 2412 wrote to memory of 2020	2412	RtDCpl64.exe	RtDCpl64.exe
PID 2412 wrote to memory of 1740	2412	RtDCpl64.exe	schtasks.exe
PID 2412 wrote to memory of 1740	2412	RtDCpl64.exe	schtasks.exe
PID 2412 wrote to memory of 1740	2412	RtDCpl64.exe	schtasks.exe
PID 2412 wrote to memory of 1740	2412	RtDCpl64.exe	schtasks.exe
PID 2020 wrote to memory of 2780	2020	RtDCpl64.exe	cmd.exe
PID 2020 wrote to memory of 2780	2020	RtDCpl64.exe	cmd.exe
PID 2020 wrote to memory of 2780	2020	RtDCpl64.exe	cmd.exe
PID 2020 wrote to memory of 2780	2020	RtDCpl64.exe	cmd.exe
PID 2020 wrote to memory of 2780	2020	RtDCpl64.exe	cmd.exe
PID 2020 wrote to memory of 2780	2020	RtDCpl64.exe	cmd.exe
PID 2660 wrote to memory of 1188	2660	taskeng.exe	RtDCpl64.exe
PID 2660 wrote to memory of 1188	2660	taskeng.exe	RtDCpl64.exe
PID 2660 wrote to memory of 1188	2660	taskeng.exe	RtDCpl64.exe
PID 2660 wrote to memory of 1188	2660	taskeng.exe	RtDCpl64.exe
PID 1188 wrote to memory of 1064	1188	RtDCpl64.exe	Blasthost.exe
PID 1188 wrote to memory of 1064	1188	RtDCpl64.exe	Blasthost.exe
PID 1188 wrote to memory of 1064	1188	RtDCpl64.exe	Blasthost.exe
PID 1188 wrote to memory of 1064	1188	RtDCpl64.exe	Blasthost.exe
PID 1188 wrote to memory of 1320	1188	RtDCpl64.exe	RtDCpl64.exe
PID 1188 wrote to memory of 1320	1188	RtDCpl64.exe	RtDCpl64.exe
PID 1188 wrote to memory of 1320	1188	RtDCpl64.exe	RtDCpl64.exe
PID 1188 wrote to memory of 1320	1188	RtDCpl64.exe	RtDCpl64.exe
PID 1188 wrote to memory of 1320	1188	RtDCpl64.exe	RtDCpl64.exe
PID 1188 wrote to memory of 1320	1188	RtDCpl64.exe	RtDCpl64.exe
PID 1188 wrote to memory of 1876	1188	RtDCpl64.exe	schtasks.exe
PID 1188 wrote to memory of 1876	1188	RtDCpl64.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3040

C:\Users\Admin\AppData\Roaming\Blasthost.exe
"C:\Users\Admin\AppData\Roaming\Blasthost.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1088

C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"
3⤵
- Executes dropped EXE
PID:2924

C:\Users\Admin\AppData\Local\Temp\96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\96681701b216b38eff5b1dd3b15872a82e94316ca92aef4235233baab02242f2_NeikiAnalytics.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2840

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
3⤵
PID:2732

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\taskeng.exe
taskeng.exe {C5F02F1B-08ED-47EC-8E4E-131351816C36} S-1-5-21-2812790648-3157963462-487717889-1000:JAFTUVRJ\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2660

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2412

C:\Users\Admin\AppData\Roaming\Blasthost.exe
"C:\Users\Admin\AppData\Roaming\Blasthost.exe"
3⤵
- Executes dropped EXE
PID:2560

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
4⤵
PID:2780

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1740

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1188

C:\Users\Admin\AppData\Roaming\Blasthost.exe
"C:\Users\Admin\AppData\Roaming\Blasthost.exe"
3⤵
- Executes dropped EXE
PID:1064

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
3⤵
- Executes dropped EXE
PID:1320

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
4⤵
PID:1808

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1876

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
Filesize
1.3MB

MD5
7806b7d0b3ed72b0f605d4acf6741b2f

SHA1
b248bb9f5987d6e7e6b2b24fbf6a6e6a28432198

SHA256
14d4b9aed0f07c1f3f0d6653f8dd92ec22ee806c6215c065a49662b1196ac254

SHA512
b23642ce9879840cfef2bba8115c010130b93282b881ece057a026676312c04c7fa85f1cf7527a05046c12c29e0962a473484d7e09fb51441a613212079c60a6

Download Submit
\Users\Admin\AppData\Roaming\Blasthost.exe
Filesize
132KB

MD5
6087bf6af59b9c531f2c9bb421d5e902

SHA1
8bc0f1596c986179b82585c703bacae6d2a00316

SHA256
3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c

SHA512
c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292

Download Submit
memory/1088-23-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1808-115-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2020-74-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2560-85-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2732-42-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2732-40-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2780-80-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2840-38-0x0000000000080000-0x000000000009D000-memory.dmp

Filesize
116KB

Download
memory/2840-26-0x0000000000080000-0x000000000009D000-memory.dmp

Filesize
116KB

Download
memory/2840-28-0x0000000000080000-0x000000000009D000-memory.dmp

Filesize
116KB

Download
memory/2840-35-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2924-45-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2924-90-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3040-25-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download