netwire | 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56

Analysis

max time kernel
154s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe
Size

356KB
MD5

e971ab88ed635c928ab36139eecbb6da
SHA1

8860910e86517a56547d2d76f7903d5313077e10
SHA256

3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56
SHA512

78d97c314561cbbd0cc7e42f0bd1560fc46d56ec5c55e8997a271c7cc0d9ccf2240fc7af33912c28c4554b39e9b5b8e44acc18b4359fc796ef92be3068298c5c
SSDEEP

6144:oTvspNdntRNxcGhGEi7F875mif7yL3OfytFd8HrI8wAcuL4u+NR94:oTspNtNxcmO7F87vf7J8Fak/uV+NR94

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4932-133-0x0000000000400000-0x0000000001400000-memory.dmp	netwire
behavioral2/memory/4932-136-0x0000000000400000-0x0000000001400000-memory.dmp	netwire
behavioral2/memory/4932-137-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

Processes:

3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe

description	pid	process	target process
PID 5072 set thread context of 4932	5072	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe

pid	process
5072	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe
5072	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe

pid	process
5072	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe
5072	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe

description	pid	process	target process
PID 5072 wrote to memory of 4932	5072	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe
PID 5072 wrote to memory of 4932	5072	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe
PID 5072 wrote to memory of 4932	5072	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe
PID 5072 wrote to memory of 4932	5072	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe
PID 5072 wrote to memory of 4932	5072	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe
PID 5072 wrote to memory of 4932	5072	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe
PID 5072 wrote to memory of 4932	5072	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe
PID 5072 wrote to memory of 4932	5072	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe
PID 5072 wrote to memory of 4932	5072	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe
PID 5072 wrote to memory of 4932	5072	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe	3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe

C:\Users\Admin\AppData\Local\Temp\3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe
"C:\Users\Admin\AppData\Local\Temp\3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072

C:\Users\Admin\AppData\Local\Temp\3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe
C:\Users\Admin\AppData\Local\Temp\3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe
2⤵
PID:4932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4932-132-0x0000000000000000-mapping.dmp

Download
memory/4932-133-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/4932-136-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/4932-137-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5072-134-0x0000000002390000-0x0000000002394000-memory.dmp

Filesize
16KB

Download