netwire | 42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163

General

Target

42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe
Size

436KB
MD5

41b2c8f26f435bfce709422fa1ab7f2a
SHA1

047f9b1647ebda102db4feb0e3fcef8db41488c8
SHA256

42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163
SHA512

a6b8a277a966260d3bb0be3f546a0602cfbb0eb11e4381875e7ee07e457f216505572d281115c3e5683c8cd139c01263d7d15705056ef736e2d40328e80d606f

Score

10^/10

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/976-132-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/976-134-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/976-138-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

HKRUN.exe

pid process

728 HKRUN.exe

pid	process
728	HKRUN.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe

description	pid	process	target process
PID 912 set thread context of 976	912	42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe	Cvtres.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exeCvtres.exe

description	pid	process	target process
PID 912 wrote to memory of 976	912	42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe	Cvtres.exe
PID 912 wrote to memory of 976	912	42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe	Cvtres.exe
PID 912 wrote to memory of 976	912	42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe	Cvtres.exe
PID 912 wrote to memory of 976	912	42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe	Cvtres.exe
PID 912 wrote to memory of 976	912	42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe	Cvtres.exe
PID 912 wrote to memory of 976	912	42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe	Cvtres.exe
PID 912 wrote to memory of 976	912	42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe	Cvtres.exe
PID 912 wrote to memory of 976	912	42dc6f1019e1fc09805b94daf0561dbfa39b4991159f40431827ecb73c350163.exe	Cvtres.exe
PID 976 wrote to memory of 728	976	Cvtres.exe	HKRUN.exe
PID 976 wrote to memory of 728	976	Cvtres.exe	HKRUN.exe
PID 976 wrote to memory of 728	976	Cvtres.exe	HKRUN.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\Cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\Cvtres.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:976

C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe"
3⤵
- Executes dropped EXE
PID:728

C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe

Filesize
34KB

MD5
e118330b4629b12368d91b9df6488be0

SHA1
ce90218c7e3b90df2a3409ec253048bb6472c2fd

SHA256
3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

SHA512
ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe

Filesize
34KB

MD5
e118330b4629b12368d91b9df6488be0

SHA1
ce90218c7e3b90df2a3409ec253048bb6472c2fd

SHA256
3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

SHA512
ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

Download Submit
memory/728-135-0x0000000000000000-mapping.dmp

Download
memory/912-130-0x0000000074BC0000-0x0000000075171000-memory.dmp

Filesize
5.7MB

Download
memory/912-136-0x0000000074BC0000-0x0000000075171000-memory.dmp

Filesize
5.7MB

Download
memory/976-131-0x0000000000000000-mapping.dmp

Download
memory/976-132-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/976-134-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/976-138-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download