netwire | 0ad637fd2f6be43b412315027c0e2636329b7da0f51a40e80e9ad8c76558bb6b

Analysis

Target

property.exe
Size

715KB
MD5

a7ce2f883660a89695ae17ce9c60a7dc
SHA1

d1d38d629f7d86d854efef65eb81635e4ab5d9f0
SHA256

0ad637fd2f6be43b412315027c0e2636329b7da0f51a40e80e9ad8c76558bb6b
SHA512

b4158764b854f291e83bd47938b64e69029e63dc2f7bb96fc7ae11f3d9895109193e9ee0a2b2aee7d6d0b4022a38d2560cab4393609b58734326971cbd915031

Score

10^/10

NetWire RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1896-4-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

property.exe

description pid process target process

PID 1652 set thread context of 1896 1652 property.exe property.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

property.exe

pid process

1652 property.exe

description	pid	process	target process
PID 1652 set thread context of 1896	1652	property.exe	property.exe

pid	process
1652	property.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

property.exe

description	pid	process	target process
PID 1652 wrote to memory of 1896	1652	property.exe	property.exe
PID 1652 wrote to memory of 1896	1652	property.exe	property.exe
PID 1652 wrote to memory of 1896	1652	property.exe	property.exe
PID 1652 wrote to memory of 1896	1652	property.exe	property.exe
PID 1652 wrote to memory of 1896	1652	property.exe	property.exe

C:\Users\Admin\AppData\Local\Temp\property.exe
"C:\Users\Admin\AppData\Local\Temp\property.exe"
2⤵
PID:1896

memory/1896-2-0x000000000040242D-mapping.dmp

Download
memory/1896-3-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1896-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download