netwire | 6bf7a02ebe31fe6c8077ea42a7b1b18bfdc4772d2fa085f1878032271a9607d7

Analysis

Target

price list #6037202402.exe
Size

465KB
MD5

11f3c8f49b52ecd77b870057a2f8dd00
SHA1

dadc32acb4b67cb9598e5151882f058d54186f29
SHA256

0b8ba4df26521faa54246fbb3b1a32726c379453d19435663100222cc4784558
SHA512

3aac759d256df44bf269eaa9c926d8af9940672601780b48e8fc9f2c46f8aafc5d9b4436521d413e9918afbab4fdefca9936860a490e566abe62d18e54c2be7a

Score

10^/10

Family

netwire

evapimp.myq-see.com:2424

Attributes

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2452-135-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/2452-137-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/2452-138-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

price list #6037202402.exe

description pid process target process

PID 312 set thread context of 2452 312 price list #6037202402.exe price list #6037202402.exe

description	pid	process	target process
PID 312 set thread context of 2452	312	price list #6037202402.exe	price list #6037202402.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

price list #6037202402.exe

description	pid	process	target process
PID 312 wrote to memory of 2452	312	price list #6037202402.exe	price list #6037202402.exe
PID 312 wrote to memory of 2452	312	price list #6037202402.exe	price list #6037202402.exe
PID 312 wrote to memory of 2452	312	price list #6037202402.exe	price list #6037202402.exe
PID 312 wrote to memory of 2452	312	price list #6037202402.exe	price list #6037202402.exe
PID 312 wrote to memory of 2452	312	price list #6037202402.exe	price list #6037202402.exe
PID 312 wrote to memory of 2452	312	price list #6037202402.exe	price list #6037202402.exe
PID 312 wrote to memory of 2452	312	price list #6037202402.exe	price list #6037202402.exe
PID 312 wrote to memory of 2452	312	price list #6037202402.exe	price list #6037202402.exe
PID 312 wrote to memory of 2452	312	price list #6037202402.exe	price list #6037202402.exe
PID 312 wrote to memory of 2452	312	price list #6037202402.exe	price list #6037202402.exe
PID 312 wrote to memory of 2452	312	price list #6037202402.exe	price list #6037202402.exe

C:\Users\Admin\AppData\Local\Temp\price list #6037202402.exe
"{path}"
2⤵
PID:2452

memory/312-130-0x0000000000900000-0x000000000097A000-memory.dmp

Filesize
488KB

Download
memory/312-131-0x00000000052E0000-0x000000000537C000-memory.dmp

Filesize
624KB

Download
memory/312-132-0x0000000005420000-0x00000000054B2000-memory.dmp

Filesize
584KB

Download
memory/312-133-0x0000000006010000-0x00000000065B4000-memory.dmp

Filesize
5.6MB

Download
memory/2452-134-0x0000000000000000-mapping.dmp

Download
memory/2452-135-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2452-137-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2452-138-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download