netwire | 077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036

General

Target

077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe
Size

146KB
MD5

6d879127296c234ef326c04f499b20b0
SHA1

40714825beea682124743158508d19ef420ae99e
SHA256

077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036
SHA512

2cad074f419e514d8f15bfd1be4f04bf3d6214d3e12687117d2f312e57c8bf33c15386fdc10b8aa0dc52c58975346acaa7bf380ab4f26576e57ed19a55b0bd35
SSDEEP

3072:/Gdwx33IYvP7cszM4OQOY0MGpMd8ROyl+kEQPVc:/GdoI27cTn1bRfIlQ2

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 13 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1728-62-0x000000000051E000-0x0000000000535000-memory.dmp	netwire
behavioral1/memory/1728-63-0x000000000051E000-0x0000000000535000-memory.dmp	netwire
behavioral1/memory/1728-64-0x000000000051E000-0x0000000000535000-memory.dmp	netwire
behavioral1/memory/1728-67-0x000000000051E000-0x0000000000535000-memory.dmp	netwire
behavioral1/memory/1728-66-0x000000000051E000-0x0000000000535000-memory.dmp	netwire
behavioral1/memory/1728-69-0x000000000051E000-0x0000000000535000-memory.dmp	netwire
behavioral1/memory/1728-68-0x000000000051E000-0x0000000000535000-memory.dmp	netwire
behavioral1/memory/1728-70-0x000000000051E000-0x0000000000535000-memory.dmp	netwire
behavioral1/memory/1084-74-0x0000000000402196-mapping.dmp	netwire
behavioral1/memory/1084-73-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1728-76-0x000000000051E000-0x0000000000535000-memory.dmp	netwire
behavioral1/memory/1084-80-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1084-81-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

NetWall.exe

pid process

1084 NetWall.exe
Loads dropped DLL 1 IoCs

Processes:

077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe

pid process

1728 077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe

pid	process
1084	NetWall.exe

pid	process
1728	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe

description	pid	process	target process
PID 1728 set thread context of 1084	1728	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe	NetWall.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe

pid process

1728 077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe

pid process

1728 077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe

pid	process
1728	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe

pid	process
1728	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe

description	pid	process	target process
PID 1728 wrote to memory of 1084	1728	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe	NetWall.exe
PID 1728 wrote to memory of 1084	1728	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe	NetWall.exe
PID 1728 wrote to memory of 1084	1728	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe	NetWall.exe
PID 1728 wrote to memory of 1084	1728	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe	NetWall.exe
PID 1728 wrote to memory of 1084	1728	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe	NetWall.exe
PID 1728 wrote to memory of 1084	1728	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe	NetWall.exe
PID 1728 wrote to memory of 1084	1728	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe	NetWall.exe
PID 1728 wrote to memory of 1084	1728	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe	NetWall.exe
PID 1728 wrote to memory of 1084	1728	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe	NetWall.exe
PID 1728 wrote to memory of 1084	1728	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe	NetWall.exe

C:\Users\Admin\AppData\Local\Temp\077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe
"C:\Users\Admin\AppData\Local\Temp\077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728

C:\Users\Admin\AppData\Local\Temp\NetWall.exe
"C:\Users\Admin\AppData\Local\Temp\NetWall.exe"
2⤵
- Executes dropped EXE
PID:1084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NetWall.exe
Filesize
7KB

MD5
9ef74005e31bc004aa1d453c319281cf

SHA1
f7a7c7163c996ed646a54d4fa1b8566a54cfe4c4

SHA256
160ebaaf8ab932935c430400552809dc289855d32406a338b585708473ccc1fb

SHA512
2b0eb2512d0f3bc17d87804bc1e700b398be7bcdd4821805bbb3d8818e6a17c66fb6c7eec35b445fcbf3b8add55a66d4911c265d2a0a4cc31886442e7c45cdf6

Download Submit
\Users\Admin\AppData\Local\Temp\NetWall.exe
Filesize
7KB

MD5
9ef74005e31bc004aa1d453c319281cf

SHA1
f7a7c7163c996ed646a54d4fa1b8566a54cfe4c4

SHA256
160ebaaf8ab932935c430400552809dc289855d32406a338b585708473ccc1fb

SHA512
2b0eb2512d0f3bc17d87804bc1e700b398be7bcdd4821805bbb3d8818e6a17c66fb6c7eec35b445fcbf3b8add55a66d4911c265d2a0a4cc31886442e7c45cdf6

Download Submit
memory/1084-81-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1084-80-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1084-79-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1084-73-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1084-74-0x0000000000402196-mapping.dmp

Download
memory/1728-64-0x000000000051E000-0x0000000000535000-memory.dmp

Filesize
92KB

Download
memory/1728-68-0x000000000051E000-0x0000000000535000-memory.dmp

Filesize
92KB

Download
memory/1728-70-0x000000000051E000-0x0000000000535000-memory.dmp

Filesize
92KB

Download
memory/1728-69-0x000000000051E000-0x0000000000535000-memory.dmp

Filesize
92KB

Download
memory/1728-66-0x000000000051E000-0x0000000000535000-memory.dmp

Filesize
92KB

Download
memory/1728-67-0x000000000051E000-0x0000000000535000-memory.dmp

Filesize
92KB

Download
memory/1728-76-0x000000000051E000-0x0000000000535000-memory.dmp

Filesize
92KB

Download
memory/1728-56-0x000000000051E000-0x0000000000535000-memory.dmp

Filesize
92KB

Download
memory/1728-63-0x000000000051E000-0x0000000000535000-memory.dmp

Filesize
92KB

Download
memory/1728-62-0x000000000051E000-0x0000000000535000-memory.dmp

Filesize
92KB

Download
memory/1728-58-0x000000000051E000-0x0000000000535000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads