netwire | 5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb

General

Target

5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe
Size

292KB
MD5

32a4863df763521bbda8194091ac6b55
SHA1

839b12c0b149545b43cf3aab0d1750e2d6e0a663
SHA256

5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb
SHA512

647c294500a88e2ede78a66f9425ac4371726c254feb36222d27e4e8a953802595204741d0933c80d63f585d12af5685647ea809256f0209485ace0b86451d25

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1956-79-0x0000000000400000-0x000000000044F000-memory.dmp	netwire
behavioral1/memory/1956-80-0x0000000000400000-0x0000000000425000-memory.dmp	netwire
behavioral1/memory/1956-86-0x0000000000400000-0x000000000044F000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

Processes:

5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe

description	pid	process	target process
PID 860 set thread context of 1956	860	5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe	5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe

Drops file in Windows directory 2 IoCs

Processes:

5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe
File opened for modification	C:\Windows\win.ini	5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe

pid	process
860	5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe
1956	5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe

description	pid	process	target process
PID 860 wrote to memory of 1956	860	5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe	5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe
PID 860 wrote to memory of 1956	860	5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe	5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe
PID 860 wrote to memory of 1956	860	5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe	5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe
PID 860 wrote to memory of 1956	860	5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe	5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe

C:\Users\Admin\AppData\Local\Temp\5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe
"C:\Users\Admin\AppData\Local\Temp\5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860

C:\Users\Admin\AppData\Local\Temp\5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe
"C:\Users\Admin\AppData\Local\Temp\5acb47dac6f58284520fd5f815649102fd35f832aa32e56c7fe85b7e89c5a3eb.exe"
2⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win.ini

Filesize
509B

MD5
d2a2412bddba16d60ec63bd9550d933f

SHA1
deb3d3bdc9055f0b4909b31d3048446848fae0e1

SHA256
79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a

SHA512
8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

Download Submit
memory/860-70-0x0000000077980000-0x0000000077B00000-memory.dmp

Filesize
1.5MB

Download
memory/860-76-0x0000000077980000-0x0000000077B00000-memory.dmp

Filesize
1.5MB

Download
memory/860-69-0x0000000077980000-0x0000000077B00000-memory.dmp

Filesize
1.5MB

Download
memory/860-62-0x0000000077980000-0x0000000077B00000-memory.dmp

Filesize
1.5MB

Download
memory/860-63-0x0000000077980000-0x0000000077B00000-memory.dmp

Filesize
1.5MB

Download
memory/860-64-0x0000000077980000-0x0000000077B00000-memory.dmp

Filesize
1.5MB

Download
memory/860-65-0x0000000077980000-0x0000000077B00000-memory.dmp

Filesize
1.5MB

Download
memory/860-66-0x0000000077980000-0x0000000077B00000-memory.dmp

Filesize
1.5MB

Download
memory/860-67-0x0000000077980000-0x0000000077B00000-memory.dmp

Filesize
1.5MB

Download
memory/860-71-0x0000000077980000-0x0000000077B00000-memory.dmp

Filesize
1.5MB

Download
memory/860-61-0x00000000777A0000-0x0000000077949000-memory.dmp

Filesize
1.7MB

Download
memory/860-56-0x0000000076921000-0x0000000076923000-memory.dmp

Filesize
8KB

Download
memory/860-68-0x0000000077980000-0x0000000077B00000-memory.dmp

Filesize
1.5MB

Download
memory/860-60-0x00000000003C0000-0x00000000003C3000-memory.dmp

Filesize
12KB

Download
memory/860-74-0x0000000077980000-0x0000000077B00000-memory.dmp

Filesize
1.5MB

Download
memory/860-75-0x0000000077980000-0x0000000077B00000-memory.dmp

Filesize
1.5MB

Download
memory/1956-57-0x0000000000000000-mapping.dmp

Download
memory/1956-77-0x00000000777A0000-0x0000000077949000-memory.dmp

Filesize
1.7MB

Download
memory/1956-78-0x0000000077990000-0x0000000077A66000-memory.dmp

Filesize
856KB

Download
memory/1956-79-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1956-80-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1956-86-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1956-87-0x0000000000610000-0x0000000000613000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads