netwire | 309f1fdb12349a92d91f910056004bb865f1a5dd28bdedba3d969c9cdb724465

General

Target

309f1fdb.exe
Size

212KB
MD5

ef4dc688cea9947303bffe8b9952e9d4
SHA1

f37002c49495e867d1d151e33c5ece0a955b1d54
SHA256

309f1fdb12349a92d91f910056004bb865f1a5dd28bdedba3d969c9cdb724465
SHA512

f9b5bae16b810066b50c4a03e7b6cf8166df8c950bf2a3de212179fc808ed069d8c33cd8c3107e5509b90f55992f92917d07f2a2260ada8e37161dcbbd6ba50b
SSDEEP

3072:18yRG3SKAvr3Oovrz1vsRrKaIdBNU8eWg:iyRGsreovr5WKPhU

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

185.140.53.231:39560

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
sunshineslisa
install_path
%AppData%\Imgburn\Imgburn.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
sucess
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4736-135-0x0000000000000000-mapping.dmp	netwire
behavioral2/memory/4736-136-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral2/memory/4736-138-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral2/memory/4736-141-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral2/memory/1100-145-0x0000000000000000-mapping.dmp	netwire
behavioral2/memory/1100-148-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral2/memory/1100-149-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral2/memory/1100-150-0x0000000000400000-0x0000000000420000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

Imgburn.exeImgburn.exe

pid process

1600 Imgburn.exe
1100 Imgburn.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

309f1fdb.exeImgburn.exe

pid process

2096 309f1fdb.exe
1600 Imgburn.exe

pid	process
1600	Imgburn.exe
1100	Imgburn.exe

pid	process
2096	309f1fdb.exe
1600	Imgburn.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

309f1fdb.exe309f1fdb.exeImgburn.exe

description	pid	process	target process
PID 2096 wrote to memory of 4736	2096	309f1fdb.exe	309f1fdb.exe
PID 2096 wrote to memory of 4736	2096	309f1fdb.exe	309f1fdb.exe
PID 2096 wrote to memory of 4736	2096	309f1fdb.exe	309f1fdb.exe
PID 2096 wrote to memory of 4736	2096	309f1fdb.exe	309f1fdb.exe
PID 2096 wrote to memory of 4736	2096	309f1fdb.exe	309f1fdb.exe
PID 2096 wrote to memory of 4736	2096	309f1fdb.exe	309f1fdb.exe
PID 2096 wrote to memory of 4736	2096	309f1fdb.exe	309f1fdb.exe
PID 2096 wrote to memory of 4736	2096	309f1fdb.exe	309f1fdb.exe
PID 2096 wrote to memory of 4736	2096	309f1fdb.exe	309f1fdb.exe
PID 2096 wrote to memory of 4736	2096	309f1fdb.exe	309f1fdb.exe
PID 2096 wrote to memory of 4736	2096	309f1fdb.exe	309f1fdb.exe
PID 2096 wrote to memory of 4736	2096	309f1fdb.exe	309f1fdb.exe
PID 2096 wrote to memory of 4736	2096	309f1fdb.exe	309f1fdb.exe
PID 2096 wrote to memory of 4736	2096	309f1fdb.exe	309f1fdb.exe
PID 2096 wrote to memory of 4736	2096	309f1fdb.exe	309f1fdb.exe
PID 4736 wrote to memory of 1600	4736	309f1fdb.exe	Imgburn.exe
PID 4736 wrote to memory of 1600	4736	309f1fdb.exe	Imgburn.exe
PID 4736 wrote to memory of 1600	4736	309f1fdb.exe	Imgburn.exe
PID 1600 wrote to memory of 1100	1600	Imgburn.exe	Imgburn.exe
PID 1600 wrote to memory of 1100	1600	Imgburn.exe	Imgburn.exe
PID 1600 wrote to memory of 1100	1600	Imgburn.exe	Imgburn.exe
PID 1600 wrote to memory of 1100	1600	Imgburn.exe	Imgburn.exe
PID 1600 wrote to memory of 1100	1600	Imgburn.exe	Imgburn.exe
PID 1600 wrote to memory of 1100	1600	Imgburn.exe	Imgburn.exe
PID 1600 wrote to memory of 1100	1600	Imgburn.exe	Imgburn.exe
PID 1600 wrote to memory of 1100	1600	Imgburn.exe	Imgburn.exe
PID 1600 wrote to memory of 1100	1600	Imgburn.exe	Imgburn.exe
PID 1600 wrote to memory of 1100	1600	Imgburn.exe	Imgburn.exe
PID 1600 wrote to memory of 1100	1600	Imgburn.exe	Imgburn.exe
PID 1600 wrote to memory of 1100	1600	Imgburn.exe	Imgburn.exe
PID 1600 wrote to memory of 1100	1600	Imgburn.exe	Imgburn.exe
PID 1600 wrote to memory of 1100	1600	Imgburn.exe	Imgburn.exe
PID 1600 wrote to memory of 1100	1600	Imgburn.exe	Imgburn.exe

C:\Users\Admin\AppData\Local\Temp\309f1fdb.exe
"C:\Users\Admin\AppData\Local\Temp\309f1fdb.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096

C:\Users\Admin\AppData\Local\Temp\309f1fdb.exe
"C:\Users\Admin\AppData\Local\Temp\309f1fdb.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4736

C:\Users\Admin\AppData\Roaming\Imgburn\Imgburn.exe
"C:\Users\Admin\AppData\Roaming\Imgburn\Imgburn.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600

C:\Users\Admin\AppData\Roaming\Imgburn\Imgburn.exe
"C:\Users\Admin\AppData\Roaming\Imgburn\Imgburn.exe"
4⤵
- Executes dropped EXE
PID:1100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Imgburn\Imgburn.exe

Filesize
212KB

MD5
ef4dc688cea9947303bffe8b9952e9d4

SHA1
f37002c49495e867d1d151e33c5ece0a955b1d54

SHA256
309f1fdb12349a92d91f910056004bb865f1a5dd28bdedba3d969c9cdb724465

SHA512
f9b5bae16b810066b50c4a03e7b6cf8166df8c950bf2a3de212179fc808ed069d8c33cd8c3107e5509b90f55992f92917d07f2a2260ada8e37161dcbbd6ba50b

Download Submit
C:\Users\Admin\AppData\Roaming\Imgburn\Imgburn.exe

Filesize
212KB

MD5
ef4dc688cea9947303bffe8b9952e9d4

SHA1
f37002c49495e867d1d151e33c5ece0a955b1d54

SHA256
309f1fdb12349a92d91f910056004bb865f1a5dd28bdedba3d969c9cdb724465

SHA512
f9b5bae16b810066b50c4a03e7b6cf8166df8c950bf2a3de212179fc808ed069d8c33cd8c3107e5509b90f55992f92917d07f2a2260ada8e37161dcbbd6ba50b

Download Submit
C:\Users\Admin\AppData\Roaming\Imgburn\Imgburn.exe

Filesize
212KB

MD5
ef4dc688cea9947303bffe8b9952e9d4

SHA1
f37002c49495e867d1d151e33c5ece0a955b1d54

SHA256
309f1fdb12349a92d91f910056004bb865f1a5dd28bdedba3d969c9cdb724465

SHA512
f9b5bae16b810066b50c4a03e7b6cf8166df8c950bf2a3de212179fc808ed069d8c33cd8c3107e5509b90f55992f92917d07f2a2260ada8e37161dcbbd6ba50b

Download Submit
memory/1100-145-0x0000000000000000-mapping.dmp

Download
memory/1100-148-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1100-149-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1100-150-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1600-139-0x0000000000000000-mapping.dmp

Download
memory/2096-137-0x0000000000630000-0x0000000000635000-memory.dmp

Filesize
20KB

Download
memory/2096-134-0x0000000000630000-0x0000000000635000-memory.dmp

Filesize
20KB

Download
memory/4736-138-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4736-141-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4736-136-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4736-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads