netwire | ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315

General

Target

ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exe
Size

352KB
MD5

0e63bb2439aa39c56b1ac1a5e583fce3
SHA1

35b800a4aa75517d7029193b2e70e64193cf0b84
SHA256

ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315
SHA512

82e38bc6c1697907e5daae4ba2877c8568b02f6517014992720e12c47a45ae4fed180509143b3a61744c49edc7cc3140c3e173ccd83eb001d927df61caf5a80c

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

wealthwinds.ddns.net:20190

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
sunshineslisa
install_path
%AppData%\Imgburn\Host.exe
keylogger_dir
%AppData%\Logs\Imgburn\
lock_executable
false
offline_keylogger
true
password
sucess
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1900-57-0x0000000000400000-0x0000000000458000-memory.dmp	netwire
behavioral1/memory/1900-58-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/1428-73-0x0000000000400000-0x0000000000458000-memory.dmp	netwire
behavioral1/memory/1428-74-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/1428-81-0x0000000077BB0000-0x0000000077D30000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

Host.exe

pid process

1428 Host.exe

pid	process
1428	Host.exe

Loads dropped DLL 2 IoCs

Processes:

ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exe

pid	process
1900	ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exe
1900	ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exeHost.exe

pid process

1900 ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exe
1428 Host.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exe

description	pid	process	target process
PID 1900 wrote to memory of 1428	1900	ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exe	Host.exe
PID 1900 wrote to memory of 1428	1900	ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exe	Host.exe
PID 1900 wrote to memory of 1428	1900	ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exe	Host.exe
PID 1900 wrote to memory of 1428	1900	ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exe
"C:\Users\Admin\AppData\Local\Temp\ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900

C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe

Filesize
352KB

MD5
0e63bb2439aa39c56b1ac1a5e583fce3

SHA1
35b800a4aa75517d7029193b2e70e64193cf0b84

SHA256
ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315

SHA512
82e38bc6c1697907e5daae4ba2877c8568b02f6517014992720e12c47a45ae4fed180509143b3a61744c49edc7cc3140c3e173ccd83eb001d927df61caf5a80c

Download Submit
\Users\Admin\AppData\Roaming\Imgburn\Host.exe

Filesize
352KB

MD5
0e63bb2439aa39c56b1ac1a5e583fce3

SHA1
35b800a4aa75517d7029193b2e70e64193cf0b84

SHA256
ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315

SHA512
82e38bc6c1697907e5daae4ba2877c8568b02f6517014992720e12c47a45ae4fed180509143b3a61744c49edc7cc3140c3e173ccd83eb001d927df61caf5a80c

Download Submit
\Users\Admin\AppData\Roaming\Imgburn\Host.exe

Filesize
352KB

MD5
0e63bb2439aa39c56b1ac1a5e583fce3

SHA1
35b800a4aa75517d7029193b2e70e64193cf0b84

SHA256
ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315

SHA512
82e38bc6c1697907e5daae4ba2877c8568b02f6517014992720e12c47a45ae4fed180509143b3a61744c49edc7cc3140c3e173ccd83eb001d927df61caf5a80c

Download Submit
memory/1428-73-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1428-67-0x0000000000000000-mapping.dmp

Download
memory/1428-74-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1428-80-0x00000000779D0000-0x0000000077B79000-memory.dmp

Filesize
1.7MB

Download
memory/1428-81-0x0000000077BB0000-0x0000000077D30000-memory.dmp

Filesize
1.5MB

Download
memory/1900-65-0x00000000779D0000-0x0000000077B79000-memory.dmp

Filesize
1.7MB

Download
memory/1900-58-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1900-57-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1900-70-0x0000000077BB0000-0x0000000077D30000-memory.dmp

Filesize
1.5MB

Download
memory/1900-56-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads