netwire | 6bf7a02ebe31fe6c8077ea42a7b1b18bfdc4772d2fa085f1878032271a9607d7

General

Target

price list #6037202402.exe
Size

465KB
MD5

11f3c8f49b52ecd77b870057a2f8dd00
SHA1

dadc32acb4b67cb9598e5151882f058d54186f29
SHA256

0b8ba4df26521faa54246fbb3b1a32726c379453d19435663100222cc4784558
SHA512

3aac759d256df44bf269eaa9c926d8af9940672601780b48e8fc9f2c46f8aafc5d9b4436521d413e9918afbab4fdefca9936860a490e566abe62d18e54c2be7a

Score

10^/10

Family

netwire

C2

evapimp.myq-see.com:2424

Attributes

NetWire RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1396-62-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1396-63-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1396-64-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1396-66-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1396-67-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1396-68-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1396-71-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1396-72-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

price list #6037202402.exe

description pid process target process

PID 644 set thread context of 1396 644 price list #6037202402.exe price list #6037202402.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

price list #6037202402.exe

pid process

644 price list #6037202402.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

price list #6037202402.exe

description pid process

Token: SeDebugPrivilege 644 price list #6037202402.exe

description	pid	process	target process
PID 644 set thread context of 1396	644	price list #6037202402.exe	price list #6037202402.exe

pid	process
644	price list #6037202402.exe

description	pid	process
Token: SeDebugPrivilege	644	price list #6037202402.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

price list #6037202402.exe

description	pid	process	target process
PID 644 wrote to memory of 1532	644	price list #6037202402.exe	price list #6037202402.exe
PID 644 wrote to memory of 1532	644	price list #6037202402.exe	price list #6037202402.exe
PID 644 wrote to memory of 1532	644	price list #6037202402.exe	price list #6037202402.exe
PID 644 wrote to memory of 1532	644	price list #6037202402.exe	price list #6037202402.exe
PID 644 wrote to memory of 1396	644	price list #6037202402.exe	price list #6037202402.exe
PID 644 wrote to memory of 1396	644	price list #6037202402.exe	price list #6037202402.exe
PID 644 wrote to memory of 1396	644	price list #6037202402.exe	price list #6037202402.exe
PID 644 wrote to memory of 1396	644	price list #6037202402.exe	price list #6037202402.exe
PID 644 wrote to memory of 1396	644	price list #6037202402.exe	price list #6037202402.exe
PID 644 wrote to memory of 1396	644	price list #6037202402.exe	price list #6037202402.exe
PID 644 wrote to memory of 1396	644	price list #6037202402.exe	price list #6037202402.exe
PID 644 wrote to memory of 1396	644	price list #6037202402.exe	price list #6037202402.exe
PID 644 wrote to memory of 1396	644	price list #6037202402.exe	price list #6037202402.exe
PID 644 wrote to memory of 1396	644	price list #6037202402.exe	price list #6037202402.exe
PID 644 wrote to memory of 1396	644	price list #6037202402.exe	price list #6037202402.exe
PID 644 wrote to memory of 1396	644	price list #6037202402.exe	price list #6037202402.exe

C:\Users\Admin\AppData\Local\Temp\price list #6037202402.exe
"{path}"
2⤵
PID:1532

C:\Users\Admin\AppData\Local\Temp\price list #6037202402.exe
"{path}"
2⤵
PID:1396

memory/644-54-0x0000000000BE0000-0x0000000000C5A000-memory.dmp

Filesize
488KB

Download
memory/644-55-0x00000000002B0000-0x00000000002B8000-memory.dmp

Filesize
32KB

Download
memory/644-56-0x0000000002060000-0x0000000002096000-memory.dmp

Filesize
216KB

Download
memory/1396-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1396-58-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1396-60-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1396-62-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1396-63-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1396-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1396-66-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1396-67-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1396-68-0x000000000040242D-mapping.dmp

Download
memory/1396-70-0x0000000075BF1000-0x0000000075BF3000-memory.dmp

Filesize
8KB

Download
memory/1396-71-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1396-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download