netwire | 412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f

General

Target

412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f.exe
Size

540KB
MD5

e908270ed1cad4b5f2081c90ec972b13
SHA1

aa3a11069ef6f4d765c4f9fd54405434b554660b
SHA256

412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f
SHA512

ef8b4d3560bff36d34a274c4489cf000229421336d367a08c7d6423ec7195800752582091b7049fe9c4d088f9751e55e3158e6839ce593a2dc47521e739da3be

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

160.116.15.145:9921

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
lock_executable
false
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3452-139-0x0000000000400000-0x000000000048F000-memory.dmp	netwire
behavioral2/memory/3452-140-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

Processes:

412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f.exe

description	pid	process	target process
PID 1640 set thread context of 3452	1640	412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f.exe	412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f.exe

pid process

1640 412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f.exe

pid	process
1640	412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f.exe

description	pid	process	target process
PID 1640 wrote to memory of 3452	1640	412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f.exe	412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f.exe
PID 1640 wrote to memory of 3452	1640	412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f.exe	412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f.exe
PID 1640 wrote to memory of 3452	1640	412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f.exe	412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f.exe

C:\Users\Admin\AppData\Local\Temp\412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f.exe
"C:\Users\Admin\AppData\Local\Temp\412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640

C:\Users\Admin\AppData\Local\Temp\412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f.exe
C:\Users\Admin\AppData\Local\Temp\412e4f6cdf3aec4b28a107e6f7f01f9365bebe0b39e052b10537b2ea28c1340f.exe"
2⤵
PID:3452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-146-0x00007FFC4C8D0000-0x00007FFC4CAC5000-memory.dmp

Filesize
2.0MB

Download
memory/1640-134-0x0000000002330000-0x0000000002337000-memory.dmp

Filesize
28KB

Download
memory/1640-135-0x0000000077730000-0x00000000778D3000-memory.dmp

Filesize
1.6MB

Download
memory/1640-136-0x00007FFC4C8D0000-0x00007FFC4CAC5000-memory.dmp

Filesize
2.0MB

Download
memory/1640-132-0x0000000002330000-0x0000000002337000-memory.dmp

Filesize
28KB

Download
memory/3452-133-0x0000000000000000-mapping.dmp

Download
memory/3452-137-0x00007FFC4C8D0000-0x00007FFC4CAC5000-memory.dmp

Filesize
2.0MB

Download
memory/3452-138-0x0000000077730000-0x00000000778D3000-memory.dmp

Filesize
1.6MB

Download
memory/3452-139-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/3452-140-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3452-147-0x00000000020A0000-0x00000000020A7000-memory.dmp

Filesize
28KB

Download
memory/3452-148-0x00007FFC4C8D0000-0x00007FFC4CAC5000-memory.dmp

Filesize
2.0MB

Download
memory/3452-149-0x0000000077730000-0x00000000778D3000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads