netwire | a22f0ccaf502f542dae2af218319b9f14bae57849237142ea0f16bef196f4027

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2022 06:36

Target

Order NO0199344401.exe
Size

627KB
MD5

d117ae838dd79cd03233a72d679a8bac
SHA1

1e4bae77f84e868f6e306ae409e4a43cfd155a2b
SHA256

a22f0ccaf502f542dae2af218319b9f14bae57849237142ea0f16bef196f4027
SHA512

d22ba5fac4673feabb1ad9aee231f35b1ad4fc488221100cf4c2b6e1a96df57b49c2e2c60e9bfacae06c895d87ffc4e561cad85ee9fd557141582b1ee4cb4fda

Score

10^/10

Family

netwire

loffgghh.duckdns.org:3300

Attributes

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2488-136-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/2488-137-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/2488-138-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/2488-139-0x0000000000400000-0x0000000000450000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

Order NO0199344401.exe

description pid process target process

PID 2316 set thread context of 2488 2316 Order NO0199344401.exe Order NO0199344401.exe

description	pid	process	target process
PID 2316 set thread context of 2488	2316	Order NO0199344401.exe	Order NO0199344401.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Order NO0199344401.exe

description	pid	process	target process
PID 2316 wrote to memory of 2488	2316	Order NO0199344401.exe	Order NO0199344401.exe
PID 2316 wrote to memory of 2488	2316	Order NO0199344401.exe	Order NO0199344401.exe
PID 2316 wrote to memory of 2488	2316	Order NO0199344401.exe	Order NO0199344401.exe
PID 2316 wrote to memory of 2488	2316	Order NO0199344401.exe	Order NO0199344401.exe
PID 2316 wrote to memory of 2488	2316	Order NO0199344401.exe	Order NO0199344401.exe
PID 2316 wrote to memory of 2488	2316	Order NO0199344401.exe	Order NO0199344401.exe
PID 2316 wrote to memory of 2488	2316	Order NO0199344401.exe	Order NO0199344401.exe
PID 2316 wrote to memory of 2488	2316	Order NO0199344401.exe	Order NO0199344401.exe
PID 2316 wrote to memory of 2488	2316	Order NO0199344401.exe	Order NO0199344401.exe
PID 2316 wrote to memory of 2488	2316	Order NO0199344401.exe	Order NO0199344401.exe

C:\Users\Admin\AppData\Local\Temp\Order NO0199344401.exe
"C:\Users\Admin\AppData\Local\Temp\Order NO0199344401.exe"
2⤵
PID:2488

memory/2316-130-0x0000000000430000-0x00000000004D4000-memory.dmp

Filesize
656KB

Download
memory/2316-131-0x0000000005270000-0x0000000005814000-memory.dmp

Filesize
5.6MB

Download
memory/2316-132-0x0000000004D60000-0x0000000004DF2000-memory.dmp

Filesize
584KB

Download
memory/2316-133-0x0000000004D10000-0x0000000004D1A000-memory.dmp

Filesize
40KB

Download
memory/2316-134-0x000000000A430000-0x000000000A4CC000-memory.dmp

Filesize
624KB

Download
memory/2488-135-0x0000000000000000-mapping.dmp

Download
memory/2488-136-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2488-137-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2488-138-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2488-139-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download