netwire | db1f67662e5ca9e31d8b97e81868b9aac471202866dc442e3617613ab53fa2f0

Analysis

max time kernel
118s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2022 06:41

Target

86afe7748042ad36d8ad98bc9cd231d7.exe
Size

1.0MB
MD5

86afe7748042ad36d8ad98bc9cd231d7
SHA1

595630681e9a397085925fe2219a79c06baa7de9
SHA256

db1f67662e5ca9e31d8b97e81868b9aac471202866dc442e3617613ab53fa2f0
SHA512

04884dc39568b100899238937249f9ad0c897f573cda1ff849df6b701699c9d526ab8e208ec42a9ad1c275fe83fe809dbb7e3f007842fb59cbe13a0a7ed0ab6f

Score

10^/10

Family

netwire

80.66.64.136:6671

Attributes

NetWire RAT payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4684-137-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/4684-138-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/4684-139-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/4684-140-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/4684-141-0x0000000000400000-0x0000000000450000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

86afe7748042ad36d8ad98bc9cd231d7.exe

description pid process target process

PID 1728 set thread context of 4684 1728 86afe7748042ad36d8ad98bc9cd231d7.exe 86afe7748042ad36d8ad98bc9cd231d7.exe

description	pid	process	target process
PID 1728 set thread context of 4684	1728	86afe7748042ad36d8ad98bc9cd231d7.exe	86afe7748042ad36d8ad98bc9cd231d7.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

86afe7748042ad36d8ad98bc9cd231d7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

86afe7748042ad36d8ad98bc9cd231d7.exe

description pid process

Token: SeDebugPrivilege 1728 86afe7748042ad36d8ad98bc9cd231d7.exe

description	pid	process
Token: SeDebugPrivilege	1728	86afe7748042ad36d8ad98bc9cd231d7.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

86afe7748042ad36d8ad98bc9cd231d7.exe

description	pid	process	target process
PID 1728 wrote to memory of 4684	1728	86afe7748042ad36d8ad98bc9cd231d7.exe	86afe7748042ad36d8ad98bc9cd231d7.exe
PID 1728 wrote to memory of 4684	1728	86afe7748042ad36d8ad98bc9cd231d7.exe	86afe7748042ad36d8ad98bc9cd231d7.exe
PID 1728 wrote to memory of 4684	1728	86afe7748042ad36d8ad98bc9cd231d7.exe	86afe7748042ad36d8ad98bc9cd231d7.exe
PID 1728 wrote to memory of 4684	1728	86afe7748042ad36d8ad98bc9cd231d7.exe	86afe7748042ad36d8ad98bc9cd231d7.exe
PID 1728 wrote to memory of 4684	1728	86afe7748042ad36d8ad98bc9cd231d7.exe	86afe7748042ad36d8ad98bc9cd231d7.exe
PID 1728 wrote to memory of 4684	1728	86afe7748042ad36d8ad98bc9cd231d7.exe	86afe7748042ad36d8ad98bc9cd231d7.exe
PID 1728 wrote to memory of 4684	1728	86afe7748042ad36d8ad98bc9cd231d7.exe	86afe7748042ad36d8ad98bc9cd231d7.exe
PID 1728 wrote to memory of 4684	1728	86afe7748042ad36d8ad98bc9cd231d7.exe	86afe7748042ad36d8ad98bc9cd231d7.exe
PID 1728 wrote to memory of 4684	1728	86afe7748042ad36d8ad98bc9cd231d7.exe	86afe7748042ad36d8ad98bc9cd231d7.exe
PID 1728 wrote to memory of 4684	1728	86afe7748042ad36d8ad98bc9cd231d7.exe	86afe7748042ad36d8ad98bc9cd231d7.exe

C:\Users\Admin\AppData\Local\Temp\86afe7748042ad36d8ad98bc9cd231d7.exe
"C:\Users\Admin\AppData\Local\Temp\86afe7748042ad36d8ad98bc9cd231d7.exe"
2⤵
PID:4684

memory/1728-130-0x0000000000520000-0x0000000000628000-memory.dmp

Filesize
1.0MB

Download
memory/1728-131-0x0000000005510000-0x0000000005AB4000-memory.dmp

Filesize
5.6MB

Download
memory/1728-132-0x0000000005000000-0x0000000005092000-memory.dmp

Filesize
584KB

Download
memory/1728-133-0x0000000004FE0000-0x0000000004FEA000-memory.dmp

Filesize
40KB

Download
memory/1728-134-0x0000000008DD0000-0x0000000008E6C000-memory.dmp

Filesize
624KB

Download
memory/1728-135-0x0000000009140000-0x00000000091A6000-memory.dmp

Filesize
408KB

Download
memory/4684-136-0x0000000000000000-mapping.dmp

Download
memory/4684-137-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4684-138-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4684-139-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4684-140-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4684-141-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download