netwire | 1381ed889f1f7ced731bf98c6506ee7c8745a2bd91b18e219810d6ef245693a3

Analysis

max time kernel
103s
max time network
107s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
24-07-2022 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1381ed889f1f7ced731bf98c6506ee7c8745a2bd91b18e219810d6ef245693a3.exe
Size

257KB
MD5

d061f484b3b1c626e2bc98bcb19ef0d2
SHA1

bdea41d601397969d1069dd24b9d888403cd4e16
SHA256

1381ed889f1f7ced731bf98c6506ee7c8745a2bd91b18e219810d6ef245693a3
SHA512

fba73676273481afe511fb0f30d689acf98d9c442ab066ef014163bc75b85f4aea46ca67a2f592bdbe987925addeae03f98af997c0dc665e7c82000c036bb503

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

uploadp3p.publicvm.com:3372

myonlinehost.ddns.net:3372

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
H-%Rand%
install_path
%AppData%\Install\svvHost.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
wBEKeAsQ
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1208-61-0x0000000000400000-0x0000000000C46000-memory.dmp	netwire
behavioral1/memory/1776-65-0x0000000000400000-0x0000000000C46000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

svvHost.exe

pid process

1776 svvHost.exe

pid	process
1776	svvHost.exe

Loads dropped DLL 2 IoCs

Processes:

1381ed889f1f7ced731bf98c6506ee7c8745a2bd91b18e219810d6ef245693a3.exe

pid	process
1208	1381ed889f1f7ced731bf98c6506ee7c8745a2bd91b18e219810d6ef245693a3.exe
1208	1381ed889f1f7ced731bf98c6506ee7c8745a2bd91b18e219810d6ef245693a3.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1381ed889f1f7ced731bf98c6506ee7c8745a2bd91b18e219810d6ef245693a3.exe

description	pid	process	target process
PID 1208 wrote to memory of 1776	1208	1381ed889f1f7ced731bf98c6506ee7c8745a2bd91b18e219810d6ef245693a3.exe	svvHost.exe
PID 1208 wrote to memory of 1776	1208	1381ed889f1f7ced731bf98c6506ee7c8745a2bd91b18e219810d6ef245693a3.exe	svvHost.exe
PID 1208 wrote to memory of 1776	1208	1381ed889f1f7ced731bf98c6506ee7c8745a2bd91b18e219810d6ef245693a3.exe	svvHost.exe
PID 1208 wrote to memory of 1776	1208	1381ed889f1f7ced731bf98c6506ee7c8745a2bd91b18e219810d6ef245693a3.exe	svvHost.exe

C:\Users\Admin\AppData\Local\Temp\1381ed889f1f7ced731bf98c6506ee7c8745a2bd91b18e219810d6ef245693a3.exe
"C:\Users\Admin\AppData\Local\Temp\1381ed889f1f7ced731bf98c6506ee7c8745a2bd91b18e219810d6ef245693a3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1208

C:\Users\Admin\AppData\Roaming\Install\svvHost.exe
"C:\Users\Admin\AppData\Roaming\Install\svvHost.exe"
2⤵
- Executes dropped EXE
PID:1776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\svvHost.exe

Filesize
257KB

MD5
d061f484b3b1c626e2bc98bcb19ef0d2

SHA1
bdea41d601397969d1069dd24b9d888403cd4e16

SHA256
1381ed889f1f7ced731bf98c6506ee7c8745a2bd91b18e219810d6ef245693a3

SHA512
fba73676273481afe511fb0f30d689acf98d9c442ab066ef014163bc75b85f4aea46ca67a2f592bdbe987925addeae03f98af997c0dc665e7c82000c036bb503

Download Submit
\Users\Admin\AppData\Roaming\Install\svvHost.exe

Filesize
257KB

MD5
d061f484b3b1c626e2bc98bcb19ef0d2

SHA1
bdea41d601397969d1069dd24b9d888403cd4e16

SHA256
1381ed889f1f7ced731bf98c6506ee7c8745a2bd91b18e219810d6ef245693a3

SHA512
fba73676273481afe511fb0f30d689acf98d9c442ab066ef014163bc75b85f4aea46ca67a2f592bdbe987925addeae03f98af997c0dc665e7c82000c036bb503

Download Submit
\Users\Admin\AppData\Roaming\Install\svvHost.exe

Filesize
257KB

MD5
d061f484b3b1c626e2bc98bcb19ef0d2

SHA1
bdea41d601397969d1069dd24b9d888403cd4e16

SHA256
1381ed889f1f7ced731bf98c6506ee7c8745a2bd91b18e219810d6ef245693a3

SHA512
fba73676273481afe511fb0f30d689acf98d9c442ab066ef014163bc75b85f4aea46ca67a2f592bdbe987925addeae03f98af997c0dc665e7c82000c036bb503

Download Submit
memory/1208-54-0x00000000002E5000-0x00000000002F4000-memory.dmp

Filesize
60KB

Download
memory/1208-55-0x00000000758D1000-0x00000000758D3000-memory.dmp

Filesize
8KB

Download
memory/1208-60-0x00000000002E5000-0x00000000002F4000-memory.dmp

Filesize
60KB

Download
memory/1208-61-0x0000000000400000-0x0000000000C46000-memory.dmp

Filesize
8.3MB

Download
memory/1776-58-0x0000000000000000-mapping.dmp

Download
memory/1776-62-0x0000000000D75000-0x0000000000D84000-memory.dmp

Filesize
60KB

Download
memory/1776-64-0x0000000000D75000-0x0000000000D84000-memory.dmp

Filesize
60KB

Download
memory/1776-65-0x0000000000400000-0x0000000000C46000-memory.dmp

Filesize
8.3MB

Download