netwire | 521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe

Analysis

max time kernel
137s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
17-07-2022 04:00

Target

521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe.exe
Size

468KB
MD5

aba4534e0a32d9b6158514fd6829c29c
SHA1

855c1a2c25a270715ca58a8b2319c4538402adf5
SHA256

521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe
SHA512

ec038de9de260adff7e5d642c58598951425b0a88605da78eaf111a13a20ca9c5316d7a2b15959e92c257075c06237c6ccd3228f17395f4e80ebcb5474167458

Score

10^/10

Family

netwire

77.48.28.246:8912

Attributes

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/772-138-0x0000000000400000-0x0000000000478000-memory.dmp	netwire
behavioral2/memory/772-139-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

Processes:

521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe.exe

description	pid	process	target process
PID 4788 set thread context of 772	4788	521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe.exe	521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe.exe

pid process

4788 521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe.exe

pid	process
4788	521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe.exe

description	pid	process	target process
PID 4788 wrote to memory of 772	4788	521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe.exe	521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe.exe
PID 4788 wrote to memory of 772	4788	521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe.exe	521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe.exe
PID 4788 wrote to memory of 772	4788	521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe.exe	521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe.exe

C:\Users\Admin\AppData\Local\Temp\521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe.exe
C:\Users\Admin\AppData\Local\Temp\521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe.exe"
2⤵
PID:772

memory/772-133-0x0000000000000000-mapping.dmp

Download
memory/772-137-0x00000000004C0000-0x00000000004C7000-memory.dmp

Filesize
28KB

Download
memory/772-138-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/772-139-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/772-145-0x00007FFCDC030000-0x00007FFCDC225000-memory.dmp

Filesize
2.0MB

Download
memory/772-146-0x0000000077320000-0x00000000774C3000-memory.dmp

Filesize
1.6MB

Download
memory/772-147-0x00000000004C0000-0x00000000004C7000-memory.dmp

Filesize
28KB

Download
memory/4788-132-0x00000000020F0000-0x00000000020F7000-memory.dmp

Filesize
28KB

Download
memory/4788-134-0x00000000020F0000-0x00000000020F7000-memory.dmp

Filesize
28KB

Download
memory/4788-135-0x00007FFCDC030000-0x00007FFCDC225000-memory.dmp

Filesize
2.0MB

Download
memory/4788-136-0x0000000077320000-0x00000000774C3000-memory.dmp

Filesize
1.6MB

Download