netwire | e9cc0af19d1d8bafdef3ffb9dae747c83cce8b83718ca9d6ef95c80d6e66b344

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17-08-2022 04:21

Target

PO.17822.pdf.exe
Size

745KB
MD5

de9b712ef2b81341e7ffbc46ffc10f33
SHA1

5bdfb2bed56472cf2c57aefaafa28c6d7e21fa8d
SHA256

e9cc0af19d1d8bafdef3ffb9dae747c83cce8b83718ca9d6ef95c80d6e66b344
SHA512

0a9a1d1638a83544c239e62c08eef023834812d6267304ee879a2aa2bb744685254afe83993718de76467bb975de75e6c745383c6cee30bae8459feef20c168c

Score

10^/10

Family

netwire

ingobea.hopto.org:6671

Attributes

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2472-138-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/2472-139-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/2472-140-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/2472-141-0x0000000000400000-0x0000000000450000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

PO.17822.pdf.exe

description pid process target process

PID 364 set thread context of 2472 364 PO.17822.pdf.exe PO.17822.pdf.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

PO.17822.pdf.exe

pid process

364 PO.17822.pdf.exe
364 PO.17822.pdf.exe
364 PO.17822.pdf.exe
364 PO.17822.pdf.exe
364 PO.17822.pdf.exe
364 PO.17822.pdf.exe
364 PO.17822.pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PO.17822.pdf.exe

description pid process

Token: SeDebugPrivilege 364 PO.17822.pdf.exe

description	pid	process	target process
PID 364 set thread context of 2472	364	PO.17822.pdf.exe	PO.17822.pdf.exe

description	pid	process
Token: SeDebugPrivilege	364	PO.17822.pdf.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

PO.17822.pdf.exe

description	pid	process	target process
PID 364 wrote to memory of 2472	364	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 364 wrote to memory of 2472	364	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 364 wrote to memory of 2472	364	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 364 wrote to memory of 2472	364	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 364 wrote to memory of 2472	364	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 364 wrote to memory of 2472	364	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 364 wrote to memory of 2472	364	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 364 wrote to memory of 2472	364	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 364 wrote to memory of 2472	364	PO.17822.pdf.exe	PO.17822.pdf.exe
PID 364 wrote to memory of 2472	364	PO.17822.pdf.exe	PO.17822.pdf.exe

C:\Users\Admin\AppData\Local\Temp\PO.17822.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PO.17822.pdf.exe"
2⤵
PID:2472

memory/364-132-0x00000000004D0000-0x000000000058E000-memory.dmp

Filesize
760KB

Download
memory/364-133-0x00000000054D0000-0x0000000005A74000-memory.dmp

Filesize
5.6MB

Download
memory/364-134-0x0000000004FC0000-0x0000000005052000-memory.dmp

Filesize
584KB

Download
memory/364-135-0x0000000004F30000-0x0000000004F3A000-memory.dmp

Filesize
40KB

Download
memory/364-136-0x000000000AFC0000-0x000000000B05C000-memory.dmp

Filesize
624KB

Download
memory/2472-137-0x0000000000000000-mapping.dmp

Download
memory/2472-138-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2472-139-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2472-140-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2472-141-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download