netwire | f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498

General

Target

f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
Size

636KB
MD5

dd132cc2a4f699b5113b72093c63ebc8
SHA1

0e65f333748c27594f91e5a70b986bb9da7cec40
SHA256

f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498
SHA512

379338d47f7a6d0ff4151d371f0a1430607eb5ac3517779e73c8a811b773aec826819fc943d9a5743a7bbced38127f81b27745083eb43324d39f661d3b3f729f

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

185.208.211.218:1122

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
lock_executable
false
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1764-133-0x0000000000000000-mapping.dmp	netwire
behavioral2/memory/1764-134-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/1764-136-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/1764-137-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe

pid process

2244 f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe

pid	process
2244	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe

C:\Users\Admin\AppData\Local\Temp\f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
"C:\Users\Admin\AppData\Local\Temp\f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244

C:\Users\Admin\AppData\Local\Temp\f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
"C:\Users\Admin\AppData\Local\Temp\f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe"
2⤵
PID:1764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1764-133-0x0000000000000000-mapping.dmp

Download
memory/1764-134-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1764-136-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1764-137-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2244-132-0x0000000002270000-0x0000000002276000-memory.dmp

Filesize
24KB

Download
memory/2244-135-0x0000000002270000-0x0000000002276000-memory.dmp

Filesize
24KB

Download

description	pid	process	target process
PID 2244 wrote to memory of 1764	2244	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 2244 wrote to memory of 1764	2244	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 2244 wrote to memory of 1764	2244	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 2244 wrote to memory of 1764	2244	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 2244 wrote to memory of 1764	2244	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 2244 wrote to memory of 1764	2244	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 2244 wrote to memory of 1764	2244	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 2244 wrote to memory of 1764	2244	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 2244 wrote to memory of 1764	2244	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 2244 wrote to memory of 1764	2244	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 2244 wrote to memory of 1764	2244	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 2244 wrote to memory of 1764	2244	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 2244 wrote to memory of 1764	2244	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 2244 wrote to memory of 1764	2244	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 2244 wrote to memory of 1764	2244	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 2244 wrote to memory of 1764	2244	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe
PID 2244 wrote to memory of 1764	2244	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe	f2ce2e0e237525169977fecb2d462f10558c7a519aab80261a51f0e046742498.exe

Analysis

Sharing