netwire | ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315

Analysis

max time kernel
146s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2022 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exe
Size

352KB
MD5

0e63bb2439aa39c56b1ac1a5e583fce3
SHA1

35b800a4aa75517d7029193b2e70e64193cf0b84
SHA256

ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315
SHA512

82e38bc6c1697907e5daae4ba2877c8568b02f6517014992720e12c47a45ae4fed180509143b3a61744c49edc7cc3140c3e173ccd83eb001d927df61caf5a80c

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

wealthwinds.ddns.net:20190

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
sunshineslisa
install_path
%AppData%\Imgburn\Host.exe
keylogger_dir
%AppData%\Logs\Imgburn\
lock_executable
false
offline_keylogger
true
password
sucess
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2612-132-0x0000000000400000-0x0000000000458000-memory.dmp	netwire
behavioral2/memory/2612-133-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/460-146-0x0000000000400000-0x0000000000458000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

Host.exe

pid process

460 Host.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exeHost.exe

pid process

2612 ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exe
460 Host.exe

pid	process
460	Host.exe

pid	process
2612	ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exe
460	Host.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exe

description	pid	process	target process
PID 2612 wrote to memory of 460	2612	ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exe	Host.exe
PID 2612 wrote to memory of 460	2612	ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exe	Host.exe
PID 2612 wrote to memory of 460	2612	ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exe
"C:\Users\Admin\AppData\Local\Temp\ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612

C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe

Filesize
352KB

MD5
0e63bb2439aa39c56b1ac1a5e583fce3

SHA1
35b800a4aa75517d7029193b2e70e64193cf0b84

SHA256
ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315

SHA512
82e38bc6c1697907e5daae4ba2877c8568b02f6517014992720e12c47a45ae4fed180509143b3a61744c49edc7cc3140c3e173ccd83eb001d927df61caf5a80c

Download Submit
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe

Filesize
352KB

MD5
0e63bb2439aa39c56b1ac1a5e583fce3

SHA1
35b800a4aa75517d7029193b2e70e64193cf0b84

SHA256
ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315

SHA512
82e38bc6c1697907e5daae4ba2877c8568b02f6517014992720e12c47a45ae4fed180509143b3a61744c49edc7cc3140c3e173ccd83eb001d927df61caf5a80c

Download Submit
memory/460-139-0x0000000000000000-mapping.dmp

Download
memory/460-146-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/460-153-0x00007FF9E4EB0000-0x00007FF9E50A5000-memory.dmp

Filesize
2.0MB

Download
memory/460-154-0x0000000077550000-0x00000000776F3000-memory.dmp

Filesize
1.6MB

Download
memory/2612-132-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2612-133-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2612-142-0x00007FF9E4EB0000-0x00007FF9E50A5000-memory.dmp

Filesize
2.0MB

Download
memory/2612-145-0x0000000077550000-0x00000000776F3000-memory.dmp

Filesize
1.6MB

Download
memory/2612-155-0x0000000077550000-0x00000000776F3000-memory.dmp

Filesize
1.6MB

Download