netwire | a22f0ccaf502f542dae2af218319b9f14bae57849237142ea0f16bef196f4027

Analysis

max time kernel
70s
max time network
101s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
25-07-2022 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Order NO0199344401.exe
Size

627KB
MD5

d117ae838dd79cd03233a72d679a8bac
SHA1

1e4bae77f84e868f6e306ae409e4a43cfd155a2b
SHA256

a22f0ccaf502f542dae2af218319b9f14bae57849237142ea0f16bef196f4027
SHA512

d22ba5fac4673feabb1ad9aee231f35b1ad4fc488221100cf4c2b6e1a96df57b49c2e2c60e9bfacae06c895d87ffc4e561cad85ee9fd557141582b1ee4cb4fda

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

loffgghh.duckdns.org:3300

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
lock_executable
false
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1596-65-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1596-67-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1596-68-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1596-70-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1596-71-0x000000000041AE7B-mapping.dmp	netwire
behavioral1/memory/1596-74-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1596-75-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/1596-76-0x0000000000400000-0x0000000000450000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

Order NO0199344401.exe

description pid process target process

PID 1940 set thread context of 1596 1940 Order NO0199344401.exe Order NO0199344401.exe

description	pid	process	target process
PID 1940 set thread context of 1596	1940	Order NO0199344401.exe	Order NO0199344401.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Order NO0199344401.exe

description	pid	process	target process
PID 1940 wrote to memory of 1596	1940	Order NO0199344401.exe	Order NO0199344401.exe
PID 1940 wrote to memory of 1596	1940	Order NO0199344401.exe	Order NO0199344401.exe
PID 1940 wrote to memory of 1596	1940	Order NO0199344401.exe	Order NO0199344401.exe
PID 1940 wrote to memory of 1596	1940	Order NO0199344401.exe	Order NO0199344401.exe
PID 1940 wrote to memory of 1596	1940	Order NO0199344401.exe	Order NO0199344401.exe
PID 1940 wrote to memory of 1596	1940	Order NO0199344401.exe	Order NO0199344401.exe
PID 1940 wrote to memory of 1596	1940	Order NO0199344401.exe	Order NO0199344401.exe
PID 1940 wrote to memory of 1596	1940	Order NO0199344401.exe	Order NO0199344401.exe
PID 1940 wrote to memory of 1596	1940	Order NO0199344401.exe	Order NO0199344401.exe
PID 1940 wrote to memory of 1596	1940	Order NO0199344401.exe	Order NO0199344401.exe
PID 1940 wrote to memory of 1596	1940	Order NO0199344401.exe	Order NO0199344401.exe

C:\Users\Admin\AppData\Local\Temp\Order NO0199344401.exe
"C:\Users\Admin\AppData\Local\Temp\Order NO0199344401.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1940

C:\Users\Admin\AppData\Local\Temp\Order NO0199344401.exe
"C:\Users\Admin\AppData\Local\Temp\Order NO0199344401.exe"
2⤵
PID:1596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1596-70-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1596-68-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1596-63-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1596-76-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1596-65-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1596-75-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1596-60-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1596-67-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1596-74-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1596-71-0x000000000041AE7B-mapping.dmp

Download
memory/1596-61-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1940-59-0x0000000005180000-0x00000000051CA000-memory.dmp

Filesize
296KB

Download
memory/1940-54-0x0000000000330000-0x00000000003D4000-memory.dmp

Filesize
656KB

Download
memory/1940-58-0x0000000005B70000-0x0000000005BF2000-memory.dmp

Filesize
520KB

Download
memory/1940-56-0x0000000000300000-0x0000000000316000-memory.dmp

Filesize
88KB

Download
memory/1940-55-0x0000000076A21000-0x0000000076A23000-memory.dmp

Filesize
8KB

Download
memory/1940-57-0x00000000003E0000-0x00000000003EA000-memory.dmp

Filesize
40KB

Download