netwire | 58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389 | Triage

Analysis

max time kernel
84s
max time network
87s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2022 06:19

Sharing

Report Analysis Logs

General

Target

58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe
Size

1.0MB
MD5

8626dbe675f9388d54ccaf173ec55fbc
SHA1

331ca65cd4ba779d767b87385cabfbe78fb8398d
SHA256

58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389
SHA512

baab118459e39af468596e38090b46e57fe65cc2c3fc3fbd2d1f25d17f610e4f956a9f5c2bfbec39f3047169f4e05c797f6b93a590670ebfa903d6ae2d9e40f1

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

freststatzz.ddns.net:3361

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
15
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
wtxAwUGY
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1064-133-0x00000000001A0000-0x00000000001CC000-memory.dmp	netwire
behavioral2/memory/1064-142-0x00000000001A0000-0x00000000001CC000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Drops startup file 1 IoCs

Processes:

58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\odbcconf.vbs	58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe

description	pid	process	target process
PID 8 set thread context of 1064	8	58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe	58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe

pid	process
8	58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe
8	58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe
8	58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe

pid	process
8	58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe
8	58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe
8	58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe

description	pid	process	target process
PID 8 wrote to memory of 1064	8	58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe	58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe
PID 8 wrote to memory of 1064	8	58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe	58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe
PID 8 wrote to memory of 1064	8	58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe	58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe
PID 8 wrote to memory of 1064	8	58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe	58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe
PID 8 wrote to memory of 1064	8	58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe	58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe

C:\Users\Admin\AppData\Local\Temp\58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe
"C:\Users\Admin\AppData\Local\Temp\58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8

C:\Users\Admin\AppData\Local\Temp\58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe
"C:\Users\Admin\AppData\Local\Temp\58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389.exe"
2⤵
PID:1064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1064-132-0x0000000000000000-mapping.dmp

Download
memory/1064-133-0x00000000001A0000-0x00000000001CC000-memory.dmp

Filesize
176KB

Download
memory/1064-142-0x00000000001A0000-0x00000000001CC000-memory.dmp

Filesize
176KB

Download