netwire | fe231e75021cd99c711cff304716f70df03ee0076084f7be2a8f37e5ead5b482

Analysis

max time kernel
104s
max time network
119s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
31-07-2022 06:33

Target

fe231e75021cd99c711cff304716f70df03ee0076084f7be2a8f37e5ead5b482.exe
Size

188KB
MD5

0cf4eaf6f59888c47b70b355980cf44f
SHA1

76749c2c56057f976962bad79a41de19ef4f21d4
SHA256

fe231e75021cd99c711cff304716f70df03ee0076084f7be2a8f37e5ead5b482
SHA512

aadce511fe2fc222271755e77e3560e865af8b34e76c84d3d9c22c1a060951f2ea342ffdc5e441a231d30ce0b7cf3a9e4985f02e3f9c235353826435667fae4f

Score

10^/10

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/240-58-0x0000000000400000-0x000000000042B000-memory.dmp	netwire
behavioral1/memory/240-59-0x0000000000400000-0x000000000042B000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Drops startup file 1 IoCs

Processes:

fe231e75021cd99c711cff304716f70df03ee0076084f7be2a8f37e5ead5b482.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvbe.vbs	fe231e75021cd99c711cff304716f70df03ee0076084f7be2a8f37e5ead5b482.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

fe231e75021cd99c711cff304716f70df03ee0076084f7be2a8f37e5ead5b482.exe

description	pid	process	target process
PID 1328 set thread context of 240	1328	fe231e75021cd99c711cff304716f70df03ee0076084f7be2a8f37e5ead5b482.exe	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

fe231e75021cd99c711cff304716f70df03ee0076084f7be2a8f37e5ead5b482.exe

pid	process
1328	fe231e75021cd99c711cff304716f70df03ee0076084f7be2a8f37e5ead5b482.exe
1328	fe231e75021cd99c711cff304716f70df03ee0076084f7be2a8f37e5ead5b482.exe
1328	fe231e75021cd99c711cff304716f70df03ee0076084f7be2a8f37e5ead5b482.exe
1328	fe231e75021cd99c711cff304716f70df03ee0076084f7be2a8f37e5ead5b482.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

fe231e75021cd99c711cff304716f70df03ee0076084f7be2a8f37e5ead5b482.exe

pid process

1328 fe231e75021cd99c711cff304716f70df03ee0076084f7be2a8f37e5ead5b482.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

fe231e75021cd99c711cff304716f70df03ee0076084f7be2a8f37e5ead5b482.exe

description	pid	process	target process
PID 1328 wrote to memory of 240	1328	fe231e75021cd99c711cff304716f70df03ee0076084f7be2a8f37e5ead5b482.exe	svchost.exe
PID 1328 wrote to memory of 240	1328	fe231e75021cd99c711cff304716f70df03ee0076084f7be2a8f37e5ead5b482.exe	svchost.exe
PID 1328 wrote to memory of 240	1328	fe231e75021cd99c711cff304716f70df03ee0076084f7be2a8f37e5ead5b482.exe	svchost.exe
PID 1328 wrote to memory of 240	1328	fe231e75021cd99c711cff304716f70df03ee0076084f7be2a8f37e5ead5b482.exe	svchost.exe
PID 1328 wrote to memory of 240	1328	fe231e75021cd99c711cff304716f70df03ee0076084f7be2a8f37e5ead5b482.exe	svchost.exe

C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\fe231e75021cd99c711cff304716f70df03ee0076084f7be2a8f37e5ead5b482.exe"
2⤵
PID:240

memory/240-56-0x00000000004026D0-mapping.dmp

Download
memory/240-58-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/240-59-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1328-54-0x0000000000130000-0x0000000000135000-memory.dmp

Filesize
20KB

Download
memory/1328-55-0x0000000076A21000-0x0000000076A23000-memory.dmp

Filesize
8KB

Download