netwire | 42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163

General

Target

42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe
Size

436KB
MD5

41b2c8f26f435bfce709422fa1ab7f2a
SHA1

047f9b1647ebda102db4feb0e3fcef8db41488c8
SHA256

42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163
SHA512

a6b8a277a966260d3bb0be3f546a0602cfbb0eb11e4381875e7ee07e457f216505572d281115c3e5683c8cd139c01263d7d15705056ef736e2d40328e80d606f

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/940-61-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/940-64-0x00000000004021DA-mapping.dmp	netwire
behavioral1/memory/940-63-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/940-68-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/940-71-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

HKRUN.exe

pid process

320 HKRUN.exe
Loads dropped DLL 1 IoCs

Processes:

Cvtres.exe

pid process

940 Cvtres.exe

pid	process
320	HKRUN.exe

pid	process
940	Cvtres.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe

description	pid	process	target process
PID 1704 set thread context of 940	1704	42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe	Cvtres.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exeCvtres.exe

description	pid	process	target process
PID 1704 wrote to memory of 940	1704	42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe	Cvtres.exe
PID 1704 wrote to memory of 940	1704	42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe	Cvtres.exe
PID 1704 wrote to memory of 940	1704	42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe	Cvtres.exe
PID 1704 wrote to memory of 940	1704	42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe	Cvtres.exe
PID 1704 wrote to memory of 940	1704	42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe	Cvtres.exe
PID 1704 wrote to memory of 940	1704	42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe	Cvtres.exe
PID 1704 wrote to memory of 940	1704	42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe	Cvtres.exe
PID 1704 wrote to memory of 940	1704	42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe	Cvtres.exe
PID 1704 wrote to memory of 940	1704	42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe	Cvtres.exe
PID 940 wrote to memory of 320	940	Cvtres.exe	HKRUN.exe
PID 940 wrote to memory of 320	940	Cvtres.exe	HKRUN.exe
PID 940 wrote to memory of 320	940	Cvtres.exe	HKRUN.exe
PID 940 wrote to memory of 320	940	Cvtres.exe	HKRUN.exe

C:\Users\Admin\AppData\Local\Temp\42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe
"C:\Users\Admin\AppData\Local\Temp\42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\Microsoft.NET\Framework\v2.0.50727\Cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\Cvtres.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:940

C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe"
3⤵
- Executes dropped EXE
PID:320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe

Filesize
31KB

MD5
ed797d8dc2c92401985d162e42ffa450

SHA1
0f02fc517c7facc4baefde4fe9467fb6488ebabe

SHA256
b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

SHA512
e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe

Filesize
31KB

MD5
ed797d8dc2c92401985d162e42ffa450

SHA1
0f02fc517c7facc4baefde4fe9467fb6488ebabe

SHA256
b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

SHA512
e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

Download Submit
memory/320-70-0x0000000000000000-mapping.dmp

Download
memory/940-64-0x00000000004021DA-mapping.dmp

Download
memory/940-59-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/940-61-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/940-63-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/940-68-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/940-57-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/940-56-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/940-71-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1704-54-0x00000000755B1000-0x00000000755B3000-memory.dmp

Filesize
8KB

Download
memory/1704-67-0x0000000074520000-0x0000000074ACB000-memory.dmp

Filesize
5.7MB

Download
memory/1704-55-0x0000000074520000-0x0000000074ACB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads