netwire | 55bbd2340d906fdf793f26e92a939659d98b759ed0f1e3d0a0761783e82ef1d1

General

Target

?????? ???????.exe
Size

1.1MB
MD5

078e87a6f5ff6b6b704a123fc7214472
SHA1

b2e08a685ef595582d7b3579066ba5172ae97293
SHA256

cf3b59c22659d7931cf9d0338d57af01d63fbb8363ebc4c86be884194ef62e40
SHA512

5da4e95e827ce1a34f5d04da9699395853d6f2f8ec3ce951ed9b0caa0820686e98d3c31ed833d71158da27109f44645a2f834f334691fd4a7a53ce23caebd21f

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

justhungry.theworkpc.com:3367

Attributes

activex_autorun
false
activex_key
copy_executable
false
delete_original
false
host_id
test
install_path
keylogger_dir
%AppData%\Logs\
lock_executable
true
mutex
rXrItmjS
offline_keylogger
true
password
Password
registry_autorun
false
startup_name
use_mutex
true

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/852-57-0x0000000000080000-0x00000000000B3000-memory.dmp	netwire
behavioral1/memory/852-66-0x000000000008242D-mapping.dmp	netwire
behavioral1/memory/852-69-0x0000000000080000-0x00000000000B3000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Drops startup file 1 IoCs

Processes:

______ _______.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AppContracts.url	______ _______.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

______ _______.exe

description pid process target process

PID 1152 set thread context of 852 1152 ______ _______.exe ______ _______.exe

description	pid	process	target process
PID 1152 set thread context of 852	1152	______ _______.exe	______ _______.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

______ _______.exe

pid	process
1152	______ _______.exe
1152	______ _______.exe
1152	______ _______.exe
1152	______ _______.exe
1152	______ _______.exe
1152	______ _______.exe
1152	______ _______.exe
1152	______ _______.exe
1152	______ _______.exe
1152	______ _______.exe
1152	______ _______.exe
1152	______ _______.exe
1152	______ _______.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

______ _______.exe

pid process

1152 ______ _______.exe
1152 ______ _______.exe
1152 ______ _______.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

______ _______.exe

pid process

1152 ______ _______.exe
1152 ______ _______.exe
1152 ______ _______.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

______ _______.exe

description	pid	process	target process
PID 1152 wrote to memory of 852	1152	______ _______.exe	______ _______.exe
PID 1152 wrote to memory of 852	1152	______ _______.exe	______ _______.exe
PID 1152 wrote to memory of 852	1152	______ _______.exe	______ _______.exe
PID 1152 wrote to memory of 852	1152	______ _______.exe	______ _______.exe
PID 1152 wrote to memory of 852	1152	______ _______.exe	______ _______.exe
PID 1152 wrote to memory of 852	1152	______ _______.exe	______ _______.exe

C:\Users\Admin\AppData\Local\Temp\______ _______.exe
"C:\Users\Admin\AppData\Local\Temp\______ _______.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1152

C:\Users\Admin\AppData\Local\Temp\______ _______.exe
"C:\Users\Admin\AppData\Local\Temp\______ _______.exe"
2⤵
PID:852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-55-0x0000000000080000-0x00000000000B3000-memory.dmp

Filesize
204KB

Download
memory/852-57-0x0000000000080000-0x00000000000B3000-memory.dmp

Filesize
204KB

Download
memory/852-66-0x000000000008242D-mapping.dmp

Download
memory/852-69-0x0000000000080000-0x00000000000B3000-memory.dmp

Filesize
204KB

Download
memory/1152-54-0x00000000763E1000-0x00000000763E3000-memory.dmp

Filesize
8KB

Download
memory/1152-70-0x0000000002B90000-0x0000000002BE1000-memory.dmp

Filesize
324KB

Download
memory/1152-71-0x0000000000980000-0x00000000009D1000-memory.dmp

Filesize
324KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads