netwire | 572bdddf123e1bddc75d4e2fc8725256bac3feaad7fcb68fd6e21e2ede310c9a

Analysis

max time kernel
148s
max time network
48s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
25-07-2022 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DHL Dhipping Invoice_pdf.exe
Size

352KB
MD5

0e63bb2439aa39c56b1ac1a5e583fce3
SHA1

35b800a4aa75517d7029193b2e70e64193cf0b84
SHA256

ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315
SHA512

82e38bc6c1697907e5daae4ba2877c8568b02f6517014992720e12c47a45ae4fed180509143b3a61744c49edc7cc3140c3e173ccd83eb001d927df61caf5a80c

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

wealthwinds.ddns.net:20190

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
sunshineslisa
install_path
%AppData%\Imgburn\Host.exe
keylogger_dir
%AppData%\Logs\Imgburn\
lock_executable
false
offline_keylogger
true
password
sucess
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/912-57-0x0000000000400000-0x0000000000458000-memory.dmp	netwire
behavioral1/memory/912-58-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/1420-73-0x0000000000400000-0x0000000000458000-memory.dmp	netwire
behavioral1/memory/1420-74-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

Host.exe

pid process

1420 Host.exe
Loads dropped DLL 2 IoCs

Processes:

DHL Dhipping Invoice_pdf.exe

pid process

912 DHL Dhipping Invoice_pdf.exe
912 DHL Dhipping Invoice_pdf.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

DHL Dhipping Invoice_pdf.exeHost.exe

pid process

912 DHL Dhipping Invoice_pdf.exe
1420 Host.exe

pid	process
1420	Host.exe

pid	process
912	DHL Dhipping Invoice_pdf.exe
912	DHL Dhipping Invoice_pdf.exe

pid	process
912	DHL Dhipping Invoice_pdf.exe
1420	Host.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

DHL Dhipping Invoice_pdf.exe

description	pid	process	target process
PID 912 wrote to memory of 1420	912	DHL Dhipping Invoice_pdf.exe	Host.exe
PID 912 wrote to memory of 1420	912	DHL Dhipping Invoice_pdf.exe	Host.exe
PID 912 wrote to memory of 1420	912	DHL Dhipping Invoice_pdf.exe	Host.exe
PID 912 wrote to memory of 1420	912	DHL Dhipping Invoice_pdf.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\DHL Dhipping Invoice_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\DHL Dhipping Invoice_pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912

C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe

Filesize
352KB

MD5
0e63bb2439aa39c56b1ac1a5e583fce3

SHA1
35b800a4aa75517d7029193b2e70e64193cf0b84

SHA256
ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315

SHA512
82e38bc6c1697907e5daae4ba2877c8568b02f6517014992720e12c47a45ae4fed180509143b3a61744c49edc7cc3140c3e173ccd83eb001d927df61caf5a80c

Download Submit
\Users\Admin\AppData\Roaming\Imgburn\Host.exe

Filesize
352KB

MD5
0e63bb2439aa39c56b1ac1a5e583fce3

SHA1
35b800a4aa75517d7029193b2e70e64193cf0b84

SHA256
ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315

SHA512
82e38bc6c1697907e5daae4ba2877c8568b02f6517014992720e12c47a45ae4fed180509143b3a61744c49edc7cc3140c3e173ccd83eb001d927df61caf5a80c

Download Submit
\Users\Admin\AppData\Roaming\Imgburn\Host.exe

Filesize
352KB

MD5
0e63bb2439aa39c56b1ac1a5e583fce3

SHA1
35b800a4aa75517d7029193b2e70e64193cf0b84

SHA256
ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315

SHA512
82e38bc6c1697907e5daae4ba2877c8568b02f6517014992720e12c47a45ae4fed180509143b3a61744c49edc7cc3140c3e173ccd83eb001d927df61caf5a80c

Download Submit
memory/912-58-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/912-56-0x0000000074DB1000-0x0000000074DB3000-memory.dmp

Filesize
8KB

Download
memory/912-57-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/912-68-0x0000000076CC0000-0x0000000076E69000-memory.dmp

Filesize
1.7MB

Download
memory/912-71-0x0000000076EA0000-0x0000000077020000-memory.dmp

Filesize
1.5MB

Download
memory/1420-66-0x0000000000000000-mapping.dmp

Download
memory/1420-73-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1420-74-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1420-80-0x0000000076CC0000-0x0000000076E69000-memory.dmp

Filesize
1.7MB

Download
memory/1420-81-0x0000000076EA0000-0x0000000077020000-memory.dmp

Filesize
1.5MB

Download