netwire | 362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a | Triage

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
26-06-2022 03:25

Sharing

Report Analysis Logs

General

Target

362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
Size

265KB
MD5

92878813dcf29561ac35fb37820839f5
SHA1

377128b7a144234b4f103c241c6bb599d79b877e
SHA256

362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a
SHA512

9f7410d93185de83761413a1c8c01d91d9120ba0c0afa1c5701338c0a0a5e379821de9fb2e7e77bca699dcc384af026857776958368f4327d87a501ebaee5a36

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

wealthyjamesbond.ddns.net:39560

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
sunshineslisa
keylogger_dir
C:\Users\Admin\AppData\Roaming\Logs\Imgburn\
lock_executable
false
offline_keylogger
true
password
sucess
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/696-133-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Drops startup file 1 IoCs

Processes:

362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.eu.url	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe

description	pid	process	target process
PID 4420 set thread context of 696	4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe

pid	process
4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe

pid	process
4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe

description	pid	process	target process
PID 4420 wrote to memory of 816	4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
PID 4420 wrote to memory of 816	4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
PID 4420 wrote to memory of 816	4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
PID 4420 wrote to memory of 2660	4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
PID 4420 wrote to memory of 2660	4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
PID 4420 wrote to memory of 2660	4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
PID 4420 wrote to memory of 696	4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
PID 4420 wrote to memory of 696	4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
PID 4420 wrote to memory of 696	4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
PID 4420 wrote to memory of 696	4420	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe	362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe

C:\Users\Admin\AppData\Local\Temp\362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
"C:\Users\Admin\AppData\Local\Temp\362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4420

C:\Users\Admin\AppData\Local\Temp\362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
"C:\Users\Admin\AppData\Local\Temp\362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe"
2⤵
PID:816

C:\Users\Admin\AppData\Local\Temp\362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
"C:\Users\Admin\AppData\Local\Temp\362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe"
2⤵
PID:2660

C:\Users\Admin\AppData\Local\Temp\362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe
"C:\Users\Admin\AppData\Local\Temp\362ade4173906284e7a589487ef006ceaff1432d4defb33f83c6e6f0bd3cb09a.exe"
2⤵
PID:696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/696-132-0x0000000000000000-mapping.dmp

Download
memory/696-133-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/816-130-0x0000000000000000-mapping.dmp

Download
memory/2660-131-0x0000000000000000-mapping.dmp

Download