netwire | 167b20bea3cf481d6b08785f82ce2f07dca108e925310df2e3c44b8f662509ec

General

Target

c67ad9e13a6d724d99a9fb69a69b7763.exe
Size

553KB
MD5

c67ad9e13a6d724d99a9fb69a69b7763
SHA1

0048692e8662bdc8b8429bfda78d108f9cc3b125
SHA256

167b20bea3cf481d6b08785f82ce2f07dca108e925310df2e3c44b8f662509ec
SHA512

94b9adfb24edf0f618da898588c8bbab3e5436be22150a15030fa60f7c5b925664b19f3e3f68e7a15f3d133e2da159a6656e9374b7c8a1e38c375ea27aa84e56

Score

10^/10

Family

netwire

C2

185.140.53.139:3367

185.140.53.139:3368

Attributes

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1296-136-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/1296-138-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/1296-139-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/1296-140-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

c67ad9e13a6d724d99a9fb69a69b7763.exe

description pid process target process

PID 4628 set thread context of 1296 4628 c67ad9e13a6d724d99a9fb69a69b7763.exe c67ad9e13a6d724d99a9fb69a69b7763.exe

description	pid	process	target process
PID 4628 set thread context of 1296	4628	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

c67ad9e13a6d724d99a9fb69a69b7763.exe

description	pid	process	target process
PID 4628 wrote to memory of 1296	4628	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe
PID 4628 wrote to memory of 1296	4628	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe
PID 4628 wrote to memory of 1296	4628	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe
PID 4628 wrote to memory of 1296	4628	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe
PID 4628 wrote to memory of 1296	4628	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe
PID 4628 wrote to memory of 1296	4628	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe
PID 4628 wrote to memory of 1296	4628	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe
PID 4628 wrote to memory of 1296	4628	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe
PID 4628 wrote to memory of 1296	4628	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe
PID 4628 wrote to memory of 1296	4628	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe
PID 4628 wrote to memory of 1296	4628	c67ad9e13a6d724d99a9fb69a69b7763.exe	c67ad9e13a6d724d99a9fb69a69b7763.exe

C:\Users\Admin\AppData\Local\Temp\c67ad9e13a6d724d99a9fb69a69b7763.exe
"C:\Users\Admin\AppData\Local\Temp\c67ad9e13a6d724d99a9fb69a69b7763.exe"
2⤵
PID:1296

memory/1296-135-0x0000000000000000-mapping.dmp

Download
memory/1296-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1296-138-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1296-139-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1296-140-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4628-130-0x0000000000E80000-0x0000000000F10000-memory.dmp

Filesize
576KB

Download
memory/4628-131-0x0000000005DE0000-0x0000000006384000-memory.dmp

Filesize
5.6MB

Download
memory/4628-132-0x0000000005830000-0x00000000058C2000-memory.dmp

Filesize
584KB

Download
memory/4628-133-0x0000000005910000-0x000000000591A000-memory.dmp

Filesize
40KB

Download
memory/4628-134-0x00000000095A0000-0x000000000963C000-memory.dmp

Filesize
624KB

Download