netwire | e8ee8827402f5843e0b4f5ff6640f1efabbc90217904998f89b308379783bc49

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2022 09:16

Target

payment confirmation.exe
Size

1.0MB
MD5

e25d9a7242d86c27e2c6221061d4f4f2
SHA1

448bc5bdf1f2d763aba2fbee233605f29ac14a40
SHA256

e8ee8827402f5843e0b4f5ff6640f1efabbc90217904998f89b308379783bc49
SHA512

2bc0e95a9e581544878fd7ae6b0f4552184846cac94a8c9e09e38c6a798029bb15b7338cbd97bcd3a6c92bd976c5369a7d1c9582f48c6608af1b525f2d123a57
SSDEEP

12288:BxzD41eG9VpJqrHD6f2fD9hmzinJxFT5jFPHRTZkOWZkQ4JR:BK1eCpJqra2fD96izF5TZk9kQ4

Score

10^/10

Family

netwire

185.136.165.182:3362

Attributes

NetWire RAT payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4304-140-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/4304-141-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/4304-142-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/4304-143-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/4304-144-0x0000000000400000-0x0000000000450000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

payment confirmation.exe

description pid process target process

PID 4204 set thread context of 4304 4204 payment confirmation.exe payment confirmation.exe

description	pid	process	target process
PID 4204 set thread context of 4304	4204	payment confirmation.exe	payment confirmation.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

payment confirmation.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

payment confirmation.exe

description pid process

Token: SeDebugPrivilege 4204 payment confirmation.exe

description	pid	process
Token: SeDebugPrivilege	4204	payment confirmation.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

payment confirmation.exe

description	pid	process	target process
PID 4204 wrote to memory of 5096	4204	payment confirmation.exe	payment confirmation.exe
PID 4204 wrote to memory of 5096	4204	payment confirmation.exe	payment confirmation.exe
PID 4204 wrote to memory of 5096	4204	payment confirmation.exe	payment confirmation.exe
PID 4204 wrote to memory of 4304	4204	payment confirmation.exe	payment confirmation.exe
PID 4204 wrote to memory of 4304	4204	payment confirmation.exe	payment confirmation.exe
PID 4204 wrote to memory of 4304	4204	payment confirmation.exe	payment confirmation.exe
PID 4204 wrote to memory of 4304	4204	payment confirmation.exe	payment confirmation.exe
PID 4204 wrote to memory of 4304	4204	payment confirmation.exe	payment confirmation.exe
PID 4204 wrote to memory of 4304	4204	payment confirmation.exe	payment confirmation.exe
PID 4204 wrote to memory of 4304	4204	payment confirmation.exe	payment confirmation.exe
PID 4204 wrote to memory of 4304	4204	payment confirmation.exe	payment confirmation.exe
PID 4204 wrote to memory of 4304	4204	payment confirmation.exe	payment confirmation.exe
PID 4204 wrote to memory of 4304	4204	payment confirmation.exe	payment confirmation.exe

C:\Users\Admin\AppData\Local\Temp\payment confirmation.exe
"C:\Users\Admin\AppData\Local\Temp\payment confirmation.exe"
2⤵
PID:5096

C:\Users\Admin\AppData\Local\Temp\payment confirmation.exe
"C:\Users\Admin\AppData\Local\Temp\payment confirmation.exe"
2⤵
PID:4304

memory/4204-132-0x0000000000120000-0x0000000000230000-memory.dmp

Filesize
1.1MB

Download
memory/4204-133-0x0000000005220000-0x00000000057C4000-memory.dmp

Filesize
5.6MB

Download
memory/4204-134-0x0000000004C70000-0x0000000004D02000-memory.dmp

Filesize
584KB

Download
memory/4204-135-0x0000000004BB0000-0x0000000004BBA000-memory.dmp

Filesize
40KB

Download
memory/4204-136-0x00000000086F0000-0x000000000878C000-memory.dmp

Filesize
624KB

Download
memory/4204-137-0x0000000008A00000-0x0000000008A66000-memory.dmp

Filesize
408KB

Download
memory/4304-141-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4304-139-0x0000000000000000-mapping.dmp

Download
memory/4304-140-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4304-142-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4304-143-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4304-144-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/5096-138-0x0000000000000000-mapping.dmp

Download