netwire | 460c0159eee76c5420f52764f87b5454babee616fb7567d0afa732dd23c1a760

General

Target

460c0159eee76c5420f52764f87b5454babee616fb7567d0afa732dd23c1a760.exe
Size

452KB
MD5

b03f9e650a80edd515eda4a49ce217d7
SHA1

083433c29dbf82ad0c434f9f65b08589dc3b06b1
SHA256

460c0159eee76c5420f52764f87b5454babee616fb7567d0afa732dd23c1a760
SHA512

10d02d8267ce6084b8c34b359aac37b02c525edef3993cdb4e5dd82f8b8c9e078c2795bdfdb047828901df69cefeb02baef620c117c5e84c9997c41b30311b79

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

77.48.28.246:8912

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
lock_executable
false
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2260-140-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/2260-139-0x0000000000400000-0x0000000000474000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

Processes:

460c0159eee76c5420f52764f87b5454babee616fb7567d0afa732dd23c1a760.exe

description	pid	process	target process
PID 388 set thread context of 2260	388	460c0159eee76c5420f52764f87b5454babee616fb7567d0afa732dd23c1a760.exe	460c0159eee76c5420f52764f87b5454babee616fb7567d0afa732dd23c1a760.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

460c0159eee76c5420f52764f87b5454babee616fb7567d0afa732dd23c1a760.exe

pid process

388 460c0159eee76c5420f52764f87b5454babee616fb7567d0afa732dd23c1a760.exe

pid	process
388	460c0159eee76c5420f52764f87b5454babee616fb7567d0afa732dd23c1a760.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

460c0159eee76c5420f52764f87b5454babee616fb7567d0afa732dd23c1a760.exe

description	pid	process	target process
PID 388 wrote to memory of 2260	388	460c0159eee76c5420f52764f87b5454babee616fb7567d0afa732dd23c1a760.exe	460c0159eee76c5420f52764f87b5454babee616fb7567d0afa732dd23c1a760.exe
PID 388 wrote to memory of 2260	388	460c0159eee76c5420f52764f87b5454babee616fb7567d0afa732dd23c1a760.exe	460c0159eee76c5420f52764f87b5454babee616fb7567d0afa732dd23c1a760.exe
PID 388 wrote to memory of 2260	388	460c0159eee76c5420f52764f87b5454babee616fb7567d0afa732dd23c1a760.exe	460c0159eee76c5420f52764f87b5454babee616fb7567d0afa732dd23c1a760.exe

C:\Users\Admin\AppData\Local\Temp\460c0159eee76c5420f52764f87b5454babee616fb7567d0afa732dd23c1a760.exe
"C:\Users\Admin\AppData\Local\Temp\460c0159eee76c5420f52764f87b5454babee616fb7567d0afa732dd23c1a760.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:388

C:\Users\Admin\AppData\Local\Temp\460c0159eee76c5420f52764f87b5454babee616fb7567d0afa732dd23c1a760.exe
C:\Users\Admin\AppData\Local\Temp\460c0159eee76c5420f52764f87b5454babee616fb7567d0afa732dd23c1a760.exe"
2⤵
PID:2260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/388-137-0x0000000077BB0000-0x0000000077D53000-memory.dmp

Filesize
1.6MB

Download
memory/388-132-0x0000000002100000-0x0000000002107000-memory.dmp

Filesize
28KB

Download
memory/388-135-0x00007FF8B8AD0000-0x00007FF8B8CC5000-memory.dmp

Filesize
2.0MB

Download
memory/388-136-0x0000000077BB0000-0x0000000077D53000-memory.dmp

Filesize
1.6MB

Download
memory/388-134-0x0000000002100000-0x0000000002107000-memory.dmp

Filesize
28KB

Download
memory/2260-138-0x00000000006A0000-0x00000000006A7000-memory.dmp

Filesize
28KB

Download
memory/2260-133-0x0000000000000000-mapping.dmp

Download
memory/2260-140-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2260-139-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2260-141-0x00007FF8B8AD0000-0x00007FF8B8CC5000-memory.dmp

Filesize
2.0MB

Download
memory/2260-144-0x0000000077BB0000-0x0000000077D53000-memory.dmp

Filesize
1.6MB

Download
memory/2260-148-0x00000000006A0000-0x00000000006A7000-memory.dmp

Filesize
28KB

Download
memory/2260-149-0x00007FF8B8AD0000-0x00007FF8B8CC5000-memory.dmp

Filesize
2.0MB

Download
memory/2260-150-0x0000000077BB0000-0x0000000077D53000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads