netwire | e8ee8827402f5843e0b4f5ff6640f1efabbc90217904998f89b308379783bc49

General

Target

payment confirmation.exe
Size

1.0MB
MD5

e25d9a7242d86c27e2c6221061d4f4f2
SHA1

448bc5bdf1f2d763aba2fbee233605f29ac14a40
SHA256

e8ee8827402f5843e0b4f5ff6640f1efabbc90217904998f89b308379783bc49
SHA512

2bc0e95a9e581544878fd7ae6b0f4552184846cac94a8c9e09e38c6a798029bb15b7338cbd97bcd3a6c92bd976c5369a7d1c9582f48c6608af1b525f2d123a57
SSDEEP

12288:BxzD41eG9VpJqrHD6f2fD9hmzinJxFT5jFPHRTZkOWZkQ4JR:BK1eCpJqra2fD96izF5TZk9kQ4

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

185.136.165.182:3362

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
Money_Man
lock_executable
false
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/944-65-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/944-67-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/944-68-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/944-71-0x000000000041AE7B-mapping.dmp	netwire
behavioral1/memory/944-70-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/944-74-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/944-75-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral1/memory/944-76-0x0000000000400000-0x0000000000450000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

payment confirmation.exe

description pid process target process

PID 576 set thread context of 944 576 payment confirmation.exe payment confirmation.exe

description	pid	process	target process
PID 576 set thread context of 944	576	payment confirmation.exe	payment confirmation.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

payment confirmation.exe

pid	process
576	payment confirmation.exe
576	payment confirmation.exe
576	payment confirmation.exe
576	payment confirmation.exe
576	payment confirmation.exe
576	payment confirmation.exe
576	payment confirmation.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

payment confirmation.exe

description pid process

Token: SeDebugPrivilege 576 payment confirmation.exe

description	pid	process
Token: SeDebugPrivilege	576	payment confirmation.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

payment confirmation.exe

description	pid	process	target process
PID 576 wrote to memory of 980	576	payment confirmation.exe	payment confirmation.exe
PID 576 wrote to memory of 980	576	payment confirmation.exe	payment confirmation.exe
PID 576 wrote to memory of 980	576	payment confirmation.exe	payment confirmation.exe
PID 576 wrote to memory of 980	576	payment confirmation.exe	payment confirmation.exe
PID 576 wrote to memory of 944	576	payment confirmation.exe	payment confirmation.exe
PID 576 wrote to memory of 944	576	payment confirmation.exe	payment confirmation.exe
PID 576 wrote to memory of 944	576	payment confirmation.exe	payment confirmation.exe
PID 576 wrote to memory of 944	576	payment confirmation.exe	payment confirmation.exe
PID 576 wrote to memory of 944	576	payment confirmation.exe	payment confirmation.exe
PID 576 wrote to memory of 944	576	payment confirmation.exe	payment confirmation.exe
PID 576 wrote to memory of 944	576	payment confirmation.exe	payment confirmation.exe
PID 576 wrote to memory of 944	576	payment confirmation.exe	payment confirmation.exe
PID 576 wrote to memory of 944	576	payment confirmation.exe	payment confirmation.exe
PID 576 wrote to memory of 944	576	payment confirmation.exe	payment confirmation.exe
PID 576 wrote to memory of 944	576	payment confirmation.exe	payment confirmation.exe

C:\Users\Admin\AppData\Local\Temp\payment confirmation.exe
"C:\Users\Admin\AppData\Local\Temp\payment confirmation.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576

C:\Users\Admin\AppData\Local\Temp\payment confirmation.exe
"C:\Users\Admin\AppData\Local\Temp\payment confirmation.exe"
2⤵
PID:980

C:\Users\Admin\AppData\Local\Temp\payment confirmation.exe
"C:\Users\Admin\AppData\Local\Temp\payment confirmation.exe"
2⤵
PID:944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-54-0x0000000000D90000-0x0000000000EA0000-memory.dmp

Filesize
1.1MB

Download
memory/576-55-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download
memory/576-56-0x0000000000930000-0x000000000094C000-memory.dmp

Filesize
112KB

Download
memory/576-57-0x0000000000950000-0x000000000095C000-memory.dmp

Filesize
48KB

Download
memory/576-58-0x0000000007F20000-0x0000000007FC4000-memory.dmp

Filesize
656KB

Download
memory/576-59-0x0000000000BD0000-0x0000000000C1A000-memory.dmp

Filesize
296KB

Download
memory/944-60-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/944-61-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/944-63-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/944-65-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/944-67-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/944-68-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/944-71-0x000000000041AE7B-mapping.dmp

Download
memory/944-70-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/944-74-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/944-75-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/944-76-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads