netwire | 39b9b9d2c699f8523e55a05bfc74f6f5764fabb0a1418f1cec4bc78609c1b37b

Analysis

max time kernel
143s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
12-08-2022 15:42

Target

Order #165-3520P-WTMM10X.exe
Size

261KB
MD5

2bf6d8556ca6620a7f3802521da5c138
SHA1

68ad243311f33ed4cfb4b3d75c9e3f0a271be58f
SHA256

39b9b9d2c699f8523e55a05bfc74f6f5764fabb0a1418f1cec4bc78609c1b37b
SHA512

9c8e092b7f786d3a768794da9ad28c257f8b78008ffa598c76f8e6ecfcc4a6af06b60a50f3faafcbf39833e0f9d5ac96d5301bc1a7ad1f9633a0378452281dcd

Score

10^/10

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3616-137-0x0000000000400000-0x0000000000444000-memory.dmp	netwire
behavioral2/memory/3616-139-0x0000000000400000-0x0000000000444000-memory.dmp	netwire
behavioral2/memory/3616-141-0x0000000000400000-0x0000000000444000-memory.dmp	netwire
behavioral2/memory/3616-142-0x0000000000400000-0x0000000000444000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Downloads MZ/PE file
Suspicious use of SetThreadContext 1 IoCs

Processes:

Order #165-3520P-WTMM10X.exe

description pid process target process

PID 3640 set thread context of 3616 3640 Order #165-3520P-WTMM10X.exe RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Order #165-3520P-WTMM10X.exe

description pid process

Token: SeDebugPrivilege 3640 Order #165-3520P-WTMM10X.exe

description	pid	process	target process
PID 3640 set thread context of 3616	3640	Order #165-3520P-WTMM10X.exe	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	3640	Order #165-3520P-WTMM10X.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Order #165-3520P-WTMM10X.exe

description	pid	process	target process
PID 3640 wrote to memory of 3616	3640	Order #165-3520P-WTMM10X.exe	RegAsm.exe
PID 3640 wrote to memory of 3616	3640	Order #165-3520P-WTMM10X.exe	RegAsm.exe
PID 3640 wrote to memory of 3616	3640	Order #165-3520P-WTMM10X.exe	RegAsm.exe
PID 3640 wrote to memory of 3616	3640	Order #165-3520P-WTMM10X.exe	RegAsm.exe
PID 3640 wrote to memory of 3616	3640	Order #165-3520P-WTMM10X.exe	RegAsm.exe
PID 3640 wrote to memory of 3616	3640	Order #165-3520P-WTMM10X.exe	RegAsm.exe
PID 3640 wrote to memory of 3616	3640	Order #165-3520P-WTMM10X.exe	RegAsm.exe
PID 3640 wrote to memory of 3616	3640	Order #165-3520P-WTMM10X.exe	RegAsm.exe
PID 3640 wrote to memory of 3616	3640	Order #165-3520P-WTMM10X.exe	RegAsm.exe
PID 3640 wrote to memory of 3616	3640	Order #165-3520P-WTMM10X.exe	RegAsm.exe
PID 3640 wrote to memory of 3616	3640	Order #165-3520P-WTMM10X.exe	RegAsm.exe
PID 3640 wrote to memory of 3616	3640	Order #165-3520P-WTMM10X.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3616

memory/3616-136-0x0000000000000000-mapping.dmp

Download
memory/3616-137-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3616-139-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3616-141-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3616-142-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3640-132-0x0000000000DF0000-0x0000000000E38000-memory.dmp

Filesize
288KB

Download
memory/3640-133-0x0000000005D30000-0x00000000062D4000-memory.dmp

Filesize
5.6MB

Download
memory/3640-134-0x0000000005820000-0x00000000058B2000-memory.dmp

Filesize
584KB

Download
memory/3640-135-0x0000000005800000-0x000000000580A000-memory.dmp

Filesize
40KB

Download