netwire | 167b20bea3cf481d6b08785f82ce2f07dca108e925310df2e3c44b8f662509ec

General

Target

c67ad9e13a6d724d99a9fb69a69b7763.exe
Size

553KB
MD5

c67ad9e13a6d724d99a9fb69a69b7763
SHA1

0048692e8662bdc8b8429bfda78d108f9cc3b125
SHA256

167b20bea3cf481d6b08785f82ce2f07dca108e925310df2e3c44b8f662509ec
SHA512

94b9adfb24edf0f618da898588c8bbab3e5436be22150a15030fa60f7c5b925664b19f3e3f68e7a15f3d133e2da159a6656e9374b7c8a1e38c375ea27aa84e56

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

185.140.53.139:3367

185.140.53.139:3368

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Telkomsa@1
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 9 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1348-66-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1348-67-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1348-68-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1348-70-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1348-71-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1348-72-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1348-75-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1348-76-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1348-77-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

c67ad9e13a6d724d99a9fb69a69b7763.exe

description pid process target process

PID 1416 set thread context of 1348 1416 c67ad9e13a6d724d99a9fb69a69b7763.exe c67ad9e13a6d724d99a9fb69a69b7763.exe

description	pid	process	target process
PID 1416 set thread context of 1348	1416	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

c67ad9e13a6d724d99a9fb69a69b7763.exe

description	pid	process	target process
PID 1416 wrote to memory of 1348	1416	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe
PID 1416 wrote to memory of 1348	1416	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe
PID 1416 wrote to memory of 1348	1416	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe
PID 1416 wrote to memory of 1348	1416	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe
PID 1416 wrote to memory of 1348	1416	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe
PID 1416 wrote to memory of 1348	1416	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe
PID 1416 wrote to memory of 1348	1416	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe
PID 1416 wrote to memory of 1348	1416	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe
PID 1416 wrote to memory of 1348	1416	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe
PID 1416 wrote to memory of 1348	1416	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe
PID 1416 wrote to memory of 1348	1416	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe
PID 1416 wrote to memory of 1348	1416	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe

C:\Users\Admin\AppData\Local\Temp\c67ad9e13a6d724d99a9fb69a69b7763.exe
"C:\Users\Admin\AppData\Local\Temp\c67ad9e13a6d724d99a9fb69a69b7763.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1416

C:\Users\Admin\AppData\Local\Temp\c67ad9e13a6d724d99a9fb69a69b7763.exe
"C:\Users\Admin\AppData\Local\Temp\c67ad9e13a6d724d99a9fb69a69b7763.exe"
2⤵
PID:1348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1348-68-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1348-70-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1348-62-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1348-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1348-76-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1348-75-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1348-72-0x000000000040242D-mapping.dmp

Download
memory/1348-61-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1348-71-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1348-77-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1348-67-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1348-66-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1416-54-0x0000000000330000-0x00000000003C0000-memory.dmp

Filesize
576KB

Download
memory/1416-55-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download
memory/1416-56-0x0000000004850000-0x00000000048C8000-memory.dmp

Filesize
480KB

Download
memory/1416-60-0x0000000001F60000-0x0000000001F8E000-memory.dmp

Filesize
184KB

Download
memory/1416-59-0x0000000004DF0000-0x0000000004E56000-memory.dmp

Filesize
408KB

Download
memory/1416-58-0x00000000003C0000-0x00000000003CE000-memory.dmp

Filesize
56KB

Download
memory/1416-57-0x00000000002F0000-0x0000000000310000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing