netwire | 309f1fdb12349a92d91f910056004bb865f1a5dd28bdedba3d969c9cdb724465

General

Target

309f1fdb.exe
Size

212KB
MD5

ef4dc688cea9947303bffe8b9952e9d4
SHA1

f37002c49495e867d1d151e33c5ece0a955b1d54
SHA256

309f1fdb12349a92d91f910056004bb865f1a5dd28bdedba3d969c9cdb724465
SHA512

f9b5bae16b810066b50c4a03e7b6cf8166df8c950bf2a3de212179fc808ed069d8c33cd8c3107e5509b90f55992f92917d07f2a2260ada8e37161dcbbd6ba50b
SSDEEP

3072:18yRG3SKAvr3Oovrz1vsRrKaIdBNU8eWg:iyRGsreovr5WKPhU

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

185.140.53.231:39560

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
sunshineslisa
install_path
%AppData%\Imgburn\Imgburn.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
sucess
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 7 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/912-58-0x0000000000000000-mapping.dmp	netwire
behavioral1/memory/912-60-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral1/memory/912-61-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral1/memory/912-66-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral1/memory/1108-71-0x0000000000000000-mapping.dmp	netwire
behavioral1/memory/1108-74-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral1/memory/1108-75-0x0000000000400000-0x0000000000420000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

Imgburn.exeImgburn.exe

pid process

1624 Imgburn.exe
1108 Imgburn.exe
Loads dropped DLL 2 IoCs

Processes:

309f1fdb.exe

pid process

912 309f1fdb.exe
912 309f1fdb.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

309f1fdb.exeImgburn.exe

pid process

1684 309f1fdb.exe
1624 Imgburn.exe

pid	process
1624	Imgburn.exe
1108	Imgburn.exe

pid	process
912	309f1fdb.exe
912	309f1fdb.exe

pid	process
1684	309f1fdb.exe
1624	Imgburn.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

309f1fdb.exe309f1fdb.exeImgburn.exe

description	pid	process	target process
PID 1684 wrote to memory of 912	1684	309f1fdb.exe	309f1fdb.exe
PID 1684 wrote to memory of 912	1684	309f1fdb.exe	309f1fdb.exe
PID 1684 wrote to memory of 912	1684	309f1fdb.exe	309f1fdb.exe
PID 1684 wrote to memory of 912	1684	309f1fdb.exe	309f1fdb.exe
PID 1684 wrote to memory of 912	1684	309f1fdb.exe	309f1fdb.exe
PID 1684 wrote to memory of 912	1684	309f1fdb.exe	309f1fdb.exe
PID 1684 wrote to memory of 912	1684	309f1fdb.exe	309f1fdb.exe
PID 1684 wrote to memory of 912	1684	309f1fdb.exe	309f1fdb.exe
PID 1684 wrote to memory of 912	1684	309f1fdb.exe	309f1fdb.exe
PID 1684 wrote to memory of 912	1684	309f1fdb.exe	309f1fdb.exe
PID 1684 wrote to memory of 912	1684	309f1fdb.exe	309f1fdb.exe
PID 1684 wrote to memory of 912	1684	309f1fdb.exe	309f1fdb.exe
PID 1684 wrote to memory of 912	1684	309f1fdb.exe	309f1fdb.exe
PID 1684 wrote to memory of 912	1684	309f1fdb.exe	309f1fdb.exe
PID 1684 wrote to memory of 912	1684	309f1fdb.exe	309f1fdb.exe
PID 1684 wrote to memory of 912	1684	309f1fdb.exe	309f1fdb.exe
PID 912 wrote to memory of 1624	912	309f1fdb.exe	Imgburn.exe
PID 912 wrote to memory of 1624	912	309f1fdb.exe	Imgburn.exe
PID 912 wrote to memory of 1624	912	309f1fdb.exe	Imgburn.exe
PID 912 wrote to memory of 1624	912	309f1fdb.exe	Imgburn.exe
PID 1624 wrote to memory of 1108	1624	Imgburn.exe	Imgburn.exe
PID 1624 wrote to memory of 1108	1624	Imgburn.exe	Imgburn.exe
PID 1624 wrote to memory of 1108	1624	Imgburn.exe	Imgburn.exe
PID 1624 wrote to memory of 1108	1624	Imgburn.exe	Imgburn.exe
PID 1624 wrote to memory of 1108	1624	Imgburn.exe	Imgburn.exe
PID 1624 wrote to memory of 1108	1624	Imgburn.exe	Imgburn.exe
PID 1624 wrote to memory of 1108	1624	Imgburn.exe	Imgburn.exe
PID 1624 wrote to memory of 1108	1624	Imgburn.exe	Imgburn.exe
PID 1624 wrote to memory of 1108	1624	Imgburn.exe	Imgburn.exe
PID 1624 wrote to memory of 1108	1624	Imgburn.exe	Imgburn.exe
PID 1624 wrote to memory of 1108	1624	Imgburn.exe	Imgburn.exe
PID 1624 wrote to memory of 1108	1624	Imgburn.exe	Imgburn.exe
PID 1624 wrote to memory of 1108	1624	Imgburn.exe	Imgburn.exe
PID 1624 wrote to memory of 1108	1624	Imgburn.exe	Imgburn.exe
PID 1624 wrote to memory of 1108	1624	Imgburn.exe	Imgburn.exe
PID 1624 wrote to memory of 1108	1624	Imgburn.exe	Imgburn.exe

C:\Users\Admin\AppData\Local\Temp\309f1fdb.exe
"C:\Users\Admin\AppData\Local\Temp\309f1fdb.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684

C:\Users\Admin\AppData\Local\Temp\309f1fdb.exe
"C:\Users\Admin\AppData\Local\Temp\309f1fdb.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:912

C:\Users\Admin\AppData\Roaming\Imgburn\Imgburn.exe
"C:\Users\Admin\AppData\Roaming\Imgburn\Imgburn.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624

C:\Users\Admin\AppData\Roaming\Imgburn\Imgburn.exe
"C:\Users\Admin\AppData\Roaming\Imgburn\Imgburn.exe"
4⤵
- Executes dropped EXE
PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Imgburn\Imgburn.exe
Filesize
212KB

MD5
ef4dc688cea9947303bffe8b9952e9d4

SHA1
f37002c49495e867d1d151e33c5ece0a955b1d54

SHA256
309f1fdb12349a92d91f910056004bb865f1a5dd28bdedba3d969c9cdb724465

SHA512
f9b5bae16b810066b50c4a03e7b6cf8166df8c950bf2a3de212179fc808ed069d8c33cd8c3107e5509b90f55992f92917d07f2a2260ada8e37161dcbbd6ba50b

Download Submit
C:\Users\Admin\AppData\Roaming\Imgburn\Imgburn.exe
Filesize
212KB

MD5
ef4dc688cea9947303bffe8b9952e9d4

SHA1
f37002c49495e867d1d151e33c5ece0a955b1d54

SHA256
309f1fdb12349a92d91f910056004bb865f1a5dd28bdedba3d969c9cdb724465

SHA512
f9b5bae16b810066b50c4a03e7b6cf8166df8c950bf2a3de212179fc808ed069d8c33cd8c3107e5509b90f55992f92917d07f2a2260ada8e37161dcbbd6ba50b

Download Submit
C:\Users\Admin\AppData\Roaming\Imgburn\Imgburn.exe
Filesize
212KB

MD5
ef4dc688cea9947303bffe8b9952e9d4

SHA1
f37002c49495e867d1d151e33c5ece0a955b1d54

SHA256
309f1fdb12349a92d91f910056004bb865f1a5dd28bdedba3d969c9cdb724465

SHA512
f9b5bae16b810066b50c4a03e7b6cf8166df8c950bf2a3de212179fc808ed069d8c33cd8c3107e5509b90f55992f92917d07f2a2260ada8e37161dcbbd6ba50b

Download Submit
\Users\Admin\AppData\Roaming\Imgburn\Imgburn.exe
Filesize
212KB

MD5
ef4dc688cea9947303bffe8b9952e9d4

SHA1
f37002c49495e867d1d151e33c5ece0a955b1d54

SHA256
309f1fdb12349a92d91f910056004bb865f1a5dd28bdedba3d969c9cdb724465

SHA512
f9b5bae16b810066b50c4a03e7b6cf8166df8c950bf2a3de212179fc808ed069d8c33cd8c3107e5509b90f55992f92917d07f2a2260ada8e37161dcbbd6ba50b

Download Submit
\Users\Admin\AppData\Roaming\Imgburn\Imgburn.exe
Filesize
212KB

MD5
ef4dc688cea9947303bffe8b9952e9d4

SHA1
f37002c49495e867d1d151e33c5ece0a955b1d54

SHA256
309f1fdb12349a92d91f910056004bb865f1a5dd28bdedba3d969c9cdb724465

SHA512
f9b5bae16b810066b50c4a03e7b6cf8166df8c950bf2a3de212179fc808ed069d8c33cd8c3107e5509b90f55992f92917d07f2a2260ada8e37161dcbbd6ba50b

Download Submit
memory/912-58-0x0000000000000000-mapping.dmp

Download
memory/912-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/912-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/912-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1108-71-0x0000000000000000-mapping.dmp

Download
memory/1108-74-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1108-75-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1624-64-0x0000000000000000-mapping.dmp

Download
memory/1684-59-0x0000000000230000-0x0000000000235000-memory.dmp

Filesize
20KB

Download
memory/1684-56-0x0000000000230000-0x0000000000235000-memory.dmp

Filesize
20KB

Download
memory/1684-57-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads