netwire | 077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036

General

Target

077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe
Size

146KB
MD5

6d879127296c234ef326c04f499b20b0
SHA1

40714825beea682124743158508d19ef420ae99e
SHA256

077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036
SHA512

2cad074f419e514d8f15bfd1be4f04bf3d6214d3e12687117d2f312e57c8bf33c15386fdc10b8aa0dc52c58975346acaa7bf380ab4f26576e57ed19a55b0bd35
SSDEEP

3072:/Gdwx33IYvP7cszM4OQOY0MGpMd8ROyl+kEQPVc:/GdoI27cTn1bRfIlQ2

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 16 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1336-140-0x0000000000755000-0x000000000076A000-memory.dmp	netwire
behavioral2/memory/1336-141-0x0000000000755000-0x000000000076A000-memory.dmp	netwire
behavioral2/memory/1336-142-0x0000000000755000-0x000000000076A000-memory.dmp	netwire
behavioral2/memory/1336-143-0x0000000000755000-0x000000000076A000-memory.dmp	netwire
behavioral2/memory/1336-144-0x0000000000755000-0x000000000076A000-memory.dmp	netwire
behavioral2/memory/1336-145-0x0000000000755000-0x000000000076A000-memory.dmp	netwire
behavioral2/memory/1336-147-0x0000000000755000-0x000000000076A000-memory.dmp	netwire
behavioral2/memory/1336-146-0x0000000000755000-0x000000000076A000-memory.dmp	netwire
behavioral2/memory/1336-148-0x0000000000755000-0x000000000076A000-memory.dmp	netwire
behavioral2/memory/1336-149-0x0000000000755000-0x000000000076A000-memory.dmp	netwire
behavioral2/memory/4164-150-0x0000000000000000-mapping.dmp	netwire
behavioral2/memory/4164-151-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/1336-156-0x0000000000755000-0x000000000076A000-memory.dmp	netwire
behavioral2/memory/1336-153-0x0000000000755000-0x000000000076A000-memory.dmp	netwire
behavioral2/memory/4164-157-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/4164-159-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

NetWall.exe

pid process

4164 NetWall.exe

pid	process
4164	NetWall.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe

description	pid	process	target process
PID 1336 set thread context of 4164	1336	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe	NetWall.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe

pid process

1336 077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe

pid process

1336 077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe

pid	process
1336	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe

pid	process
1336	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe

description	pid	process	target process
PID 1336 wrote to memory of 4164	1336	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe	NetWall.exe
PID 1336 wrote to memory of 4164	1336	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe	NetWall.exe
PID 1336 wrote to memory of 4164	1336	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe	NetWall.exe
PID 1336 wrote to memory of 4164	1336	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe	NetWall.exe
PID 1336 wrote to memory of 4164	1336	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe	NetWall.exe
PID 1336 wrote to memory of 4164	1336	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe	NetWall.exe
PID 1336 wrote to memory of 4164	1336	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe	NetWall.exe
PID 1336 wrote to memory of 4164	1336	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe	NetWall.exe
PID 1336 wrote to memory of 4164	1336	077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe	NetWall.exe

C:\Users\Admin\AppData\Local\Temp\077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe
"C:\Users\Admin\AppData\Local\Temp\077c2209b330c3dd5020f5a77a9aafd24a0195d0b0bada5860cb7fa7cd1b7036.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336

C:\Users\Admin\AppData\Local\Temp\NetWall.exe
"C:\Users\Admin\AppData\Local\Temp\NetWall.exe"
2⤵
- Executes dropped EXE
PID:4164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NetWall.exe
Filesize
7KB

MD5
9ef74005e31bc004aa1d453c319281cf

SHA1
f7a7c7163c996ed646a54d4fa1b8566a54cfe4c4

SHA256
160ebaaf8ab932935c430400552809dc289855d32406a338b585708473ccc1fb

SHA512
2b0eb2512d0f3bc17d87804bc1e700b398be7bcdd4821805bbb3d8818e6a17c66fb6c7eec35b445fcbf3b8add55a66d4911c265d2a0a4cc31886442e7c45cdf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\NetWall.exe
Filesize
7KB

MD5
9ef74005e31bc004aa1d453c319281cf

SHA1
f7a7c7163c996ed646a54d4fa1b8566a54cfe4c4

SHA256
160ebaaf8ab932935c430400552809dc289855d32406a338b585708473ccc1fb

SHA512
2b0eb2512d0f3bc17d87804bc1e700b398be7bcdd4821805bbb3d8818e6a17c66fb6c7eec35b445fcbf3b8add55a66d4911c265d2a0a4cc31886442e7c45cdf6

Download Submit
memory/1336-147-0x0000000000755000-0x000000000076A000-memory.dmp

Filesize
84KB

Download
memory/1336-146-0x0000000000755000-0x000000000076A000-memory.dmp

Filesize
84KB

Download
memory/1336-140-0x0000000000755000-0x000000000076A000-memory.dmp

Filesize
84KB

Download
memory/1336-141-0x0000000000755000-0x000000000076A000-memory.dmp

Filesize
84KB

Download
memory/1336-142-0x0000000000755000-0x000000000076A000-memory.dmp

Filesize
84KB

Download
memory/1336-143-0x0000000000755000-0x000000000076A000-memory.dmp

Filesize
84KB

Download
memory/1336-144-0x0000000000755000-0x000000000076A000-memory.dmp

Filesize
84KB

Download
memory/1336-145-0x0000000000755000-0x000000000076A000-memory.dmp

Filesize
84KB

Download
memory/1336-134-0x0000000000756000-0x000000000076D000-memory.dmp

Filesize
92KB

Download
memory/1336-138-0x0000000000756000-0x000000000076D000-memory.dmp

Filesize
92KB

Download
memory/1336-148-0x0000000000755000-0x000000000076A000-memory.dmp

Filesize
84KB

Download
memory/1336-149-0x0000000000755000-0x000000000076A000-memory.dmp

Filesize
84KB

Download
memory/1336-135-0x0000000000756000-0x000000000076D000-memory.dmp

Filesize
92KB

Download
memory/1336-153-0x0000000000755000-0x000000000076A000-memory.dmp

Filesize
84KB

Download
memory/1336-137-0x0000000000756000-0x000000000076D000-memory.dmp

Filesize
92KB

Download
memory/1336-156-0x0000000000755000-0x000000000076A000-memory.dmp

Filesize
84KB

Download
memory/4164-151-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4164-150-0x0000000000000000-mapping.dmp

Download
memory/4164-157-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4164-159-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads