netwire | f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498

General

Target

f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
Size

636KB
MD5

dd132cc2a4f699b5113b72093c63ebc8
SHA1

0e65f333748c27594f91e5a70b986bb9da7cec40
SHA256

f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498
SHA512

379338d47f7a6d0ff4151d371f0a1430607eb5ac3517779e73c8a811b773aec826819fc943d9a5743a7bbced38127f81b27745083eb43324d39f661d3b3f729f

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

185.208.211.218:1122

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
lock_executable
false
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1724-58-0x0000000000000000-mapping.dmp	netwire
behavioral1/memory/1724-60-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/1724-62-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/1724-63-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe

pid process

1364 f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe

pid	process
1364	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe

C:\Users\Admin\AppData\Local\Temp\f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
"C:\Users\Admin\AppData\Local\Temp\f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364

C:\Users\Admin\AppData\Local\Temp\f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
"C:\Users\Admin\AppData\Local\Temp\f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe"
2⤵
PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-56-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/1364-57-0x0000000075C91000-0x0000000075C93000-memory.dmp

Filesize
8KB

Download
memory/1364-59-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/1724-58-0x0000000000000000-mapping.dmp

Download
memory/1724-60-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1724-62-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1724-63-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

description	pid	process	target process
PID 1364 wrote to memory of 1724	1364	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 1364 wrote to memory of 1724	1364	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 1364 wrote to memory of 1724	1364	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 1364 wrote to memory of 1724	1364	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 1364 wrote to memory of 1724	1364	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 1364 wrote to memory of 1724	1364	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 1364 wrote to memory of 1724	1364	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 1364 wrote to memory of 1724	1364	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 1364 wrote to memory of 1724	1364	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 1364 wrote to memory of 1724	1364	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 1364 wrote to memory of 1724	1364	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 1364 wrote to memory of 1724	1364	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 1364 wrote to memory of 1724	1364	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 1364 wrote to memory of 1724	1364	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 1364 wrote to memory of 1724	1364	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 1364 wrote to memory of 1724	1364	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 1364 wrote to memory of 1724	1364	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 1364 wrote to memory of 1724	1364	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe

Analysis

Sharing