netwire | 572bdddf123e1bddc75d4e2fc8725256bac3feaad7fcb68fd6e21e2ede310c9a

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2022 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DHL Dhipping Invoice_pdf.exe
Size

352KB
MD5

0e63bb2439aa39c56b1ac1a5e583fce3
SHA1

35b800a4aa75517d7029193b2e70e64193cf0b84
SHA256

ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315
SHA512

82e38bc6c1697907e5daae4ba2877c8568b02f6517014992720e12c47a45ae4fed180509143b3a61744c49edc7cc3140c3e173ccd83eb001d927df61caf5a80c

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

wealthwinds.ddns.net:20190

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
sunshineslisa
install_path
%AppData%\Imgburn\Host.exe
keylogger_dir
%AppData%\Logs\Imgburn\
lock_executable
false
offline_keylogger
true
password
sucess
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4564-133-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/4564-132-0x0000000000400000-0x0000000000458000-memory.dmp	netwire
behavioral2/memory/444-146-0x0000000000400000-0x0000000000458000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

Host.exe

pid process

444 Host.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

DHL Dhipping Invoice_pdf.exeHost.exe

pid process

4564 DHL Dhipping Invoice_pdf.exe
444 Host.exe

pid	process
444	Host.exe

pid	process
4564	DHL Dhipping Invoice_pdf.exe
444	Host.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

DHL Dhipping Invoice_pdf.exe

description	pid	process	target process
PID 4564 wrote to memory of 444	4564	DHL Dhipping Invoice_pdf.exe	Host.exe
PID 4564 wrote to memory of 444	4564	DHL Dhipping Invoice_pdf.exe	Host.exe
PID 4564 wrote to memory of 444	4564	DHL Dhipping Invoice_pdf.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\DHL Dhipping Invoice_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\DHL Dhipping Invoice_pdf.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564

C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe

Filesize
352KB

MD5
0e63bb2439aa39c56b1ac1a5e583fce3

SHA1
35b800a4aa75517d7029193b2e70e64193cf0b84

SHA256
ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315

SHA512
82e38bc6c1697907e5daae4ba2877c8568b02f6517014992720e12c47a45ae4fed180509143b3a61744c49edc7cc3140c3e173ccd83eb001d927df61caf5a80c

Download Submit
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe

Filesize
352KB

MD5
0e63bb2439aa39c56b1ac1a5e583fce3

SHA1
35b800a4aa75517d7029193b2e70e64193cf0b84

SHA256
ae073f0c0287cc337a3ada834037fcdcef80e13df9a1310ba1e6637ce3ce0315

SHA512
82e38bc6c1697907e5daae4ba2877c8568b02f6517014992720e12c47a45ae4fed180509143b3a61744c49edc7cc3140c3e173ccd83eb001d927df61caf5a80c

Download Submit
memory/444-139-0x0000000000000000-mapping.dmp

Download
memory/444-146-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/444-153-0x00007FF8FA670000-0x00007FF8FA865000-memory.dmp

Filesize
2.0MB

Download
memory/444-154-0x0000000077C00000-0x0000000077DA3000-memory.dmp

Filesize
1.6MB

Download
memory/4564-133-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4564-132-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4564-140-0x00007FF8FA670000-0x00007FF8FA865000-memory.dmp

Filesize
2.0MB

Download
memory/4564-144-0x0000000077C00000-0x0000000077DA3000-memory.dmp

Filesize
1.6MB

Download
memory/4564-155-0x0000000077C00000-0x0000000077DA3000-memory.dmp

Filesize
1.6MB

Download