netwire | ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc

Analysis

max time kernel
89s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2022 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe
Size

372KB
MD5

48068dff85475dcd8031617e30d4f3bf
SHA1

bb78a750a8c9015ca32896346d53355810edf4bb
SHA256

ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc
SHA512

6b86edf45d0f681a3c5d061853bbb59b469236d18e0cc8199f506b7e5de5d14c9e2ea4d03a8640c58a4fac16ce92c7f49f4e64850049071edd367b28140f4694

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2100-134-0x0000000000140000-0x000000000016B000-memory.dmp	netwire
behavioral2/memory/2100-137-0x0000000000140000-0x000000000016B000-memory.dmp	netwire
behavioral2/memory/2100-141-0x0000000000140000-0x000000000016B000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

Processes:

ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe

description	pid	process	target process
PID 4792 set thread context of 2100	4792	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4308 2100 WerFault.exe ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe

pid process

4792 ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe

description pid process

Token: SeDebugPrivilege 4792 ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe

pid	pid_target	process	target process
4308	2100	WerFault.exe	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe

pid	process
4792	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe

description	pid	process
Token: SeDebugPrivilege	4792	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe

description	pid	process	target process
PID 4792 wrote to memory of 2100	4792	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe
PID 4792 wrote to memory of 2100	4792	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe
PID 4792 wrote to memory of 2100	4792	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe
PID 4792 wrote to memory of 2100	4792	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe
PID 4792 wrote to memory of 2100	4792	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe
PID 4792 wrote to memory of 2100	4792	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe
PID 4792 wrote to memory of 2100	4792	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe
PID 4792 wrote to memory of 2100	4792	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe
PID 4792 wrote to memory of 2100	4792	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe
PID 4792 wrote to memory of 2100	4792	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe	ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe

C:\Users\Admin\AppData\Local\Temp\ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe
"C:\Users\Admin\AppData\Local\Temp\ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792

C:\Users\Admin\AppData\Local\Temp\ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe
"C:/Users/Admin/AppData/Local/Temp/ddbb9e06fc1c9897376b03e1829a37799de7f0efed39a8ad5a547d77727df1dc.exe"
2⤵
PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 336
3⤵
- Program crash
PID:4308

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv hyJLfrC5R0+XGHbjLXTGQQ.0
1⤵
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2100 -ip 2100
1⤵
PID:4396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2100-132-0x0000000000000000-mapping.dmp

Download
memory/2100-134-0x0000000000140000-0x000000000016B000-memory.dmp

Filesize
172KB

Download
memory/2100-137-0x0000000000140000-0x000000000016B000-memory.dmp

Filesize
172KB

Download
memory/2100-141-0x0000000000140000-0x000000000016B000-memory.dmp

Filesize
172KB

Download
memory/4792-130-0x0000000000540000-0x00000000005A2000-memory.dmp

Filesize
392KB

Download
memory/4792-131-0x0000000004E20000-0x0000000004EBC000-memory.dmp

Filesize
624KB

Download