netwire | 0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b

General

Target

0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe
Size

124KB
MD5

fa9e61f2139112fe8ed6dbcd4e49d462
SHA1

a524b57b42bbb0962e66197b37ffbda6bc44c985
SHA256

0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b
SHA512

c8a6af6178f3dc02e23d3c6b8084060e8a3556e3064c893210d5e2e9af7dcc42fd6b15b388710a27fb31ac604f99122b03898f83970ab15483f3bd05782704b1
SSDEEP

3072:NdkI7wp1d9HHuyiVB9N45y7W88V7ZWjN0+qLIDJ:NSphnub9N45XcBzqsD

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3204-135-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/3204-137-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/3204-142-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/2780-153-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 3 IoCs

Processes:

Host.exeHost.exeHost.exe

pid process

3392 Host.exe
4292 Host.exe
2780 Host.exe

pid	process
3392	Host.exe
4292	Host.exe
2780	Host.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exeHost.exe

description	pid	process	target process
PID 1836 set thread context of 3204	1836	0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe	0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe
PID 3392 set thread context of 2780	3392	Host.exe	Host.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Host.exe

pid process

3392 Host.exe
3392 Host.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Host.exe

description pid process

Token: SeDebugPrivilege 3392 Host.exe

pid	process
3392	Host.exe
3392	Host.exe

description	pid	process
Token: SeDebugPrivilege	3392	Host.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exeHost.exe

description	pid	process	target process
PID 1836 wrote to memory of 3204	1836	0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe	0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe
PID 1836 wrote to memory of 3204	1836	0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe	0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe
PID 1836 wrote to memory of 3204	1836	0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe	0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe
PID 1836 wrote to memory of 3204	1836	0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe	0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe
PID 1836 wrote to memory of 3204	1836	0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe	0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe
PID 1836 wrote to memory of 3204	1836	0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe	0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe
PID 1836 wrote to memory of 3204	1836	0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe	0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe
PID 1836 wrote to memory of 3204	1836	0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe	0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe
PID 3204 wrote to memory of 3392	3204	0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe	Host.exe
PID 3204 wrote to memory of 3392	3204	0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe	Host.exe
PID 3204 wrote to memory of 3392	3204	0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe	Host.exe
PID 3392 wrote to memory of 4292	3392	Host.exe	Host.exe
PID 3392 wrote to memory of 4292	3392	Host.exe	Host.exe
PID 3392 wrote to memory of 4292	3392	Host.exe	Host.exe
PID 3392 wrote to memory of 2780	3392	Host.exe	Host.exe
PID 3392 wrote to memory of 2780	3392	Host.exe	Host.exe
PID 3392 wrote to memory of 2780	3392	Host.exe	Host.exe
PID 3392 wrote to memory of 2780	3392	Host.exe	Host.exe
PID 3392 wrote to memory of 2780	3392	Host.exe	Host.exe
PID 3392 wrote to memory of 2780	3392	Host.exe	Host.exe
PID 3392 wrote to memory of 2780	3392	Host.exe	Host.exe
PID 3392 wrote to memory of 2780	3392	Host.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe
"C:\Users\Admin\AppData\Local\Temp\0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1836

C:\Users\Admin\AppData\Local\Temp\0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe
"C:\Users\Admin\AppData\Local\Temp\0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3204

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
4⤵
- Executes dropped EXE
PID:4292

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
4⤵
- Executes dropped EXE
PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
124KB

MD5
fa9e61f2139112fe8ed6dbcd4e49d462

SHA1
a524b57b42bbb0962e66197b37ffbda6bc44c985

SHA256
0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b

SHA512
c8a6af6178f3dc02e23d3c6b8084060e8a3556e3064c893210d5e2e9af7dcc42fd6b15b388710a27fb31ac604f99122b03898f83970ab15483f3bd05782704b1

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
124KB

MD5
fa9e61f2139112fe8ed6dbcd4e49d462

SHA1
a524b57b42bbb0962e66197b37ffbda6bc44c985

SHA256
0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b

SHA512
c8a6af6178f3dc02e23d3c6b8084060e8a3556e3064c893210d5e2e9af7dcc42fd6b15b388710a27fb31ac604f99122b03898f83970ab15483f3bd05782704b1

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
124KB

MD5
fa9e61f2139112fe8ed6dbcd4e49d462

SHA1
a524b57b42bbb0962e66197b37ffbda6bc44c985

SHA256
0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b

SHA512
c8a6af6178f3dc02e23d3c6b8084060e8a3556e3064c893210d5e2e9af7dcc42fd6b15b388710a27fb31ac604f99122b03898f83970ab15483f3bd05782704b1

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
124KB

MD5
fa9e61f2139112fe8ed6dbcd4e49d462

SHA1
a524b57b42bbb0962e66197b37ffbda6bc44c985

SHA256
0280d01acef062c20eb217b98c954617a08e819e480a64305e0b44585b17178b

SHA512
c8a6af6178f3dc02e23d3c6b8084060e8a3556e3064c893210d5e2e9af7dcc42fd6b15b388710a27fb31ac604f99122b03898f83970ab15483f3bd05782704b1

Download Submit
memory/1836-133-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/1836-132-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/1836-140-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/2780-153-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2780-147-0x0000000000000000-mapping.dmp

Download
memory/3204-137-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3204-142-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3204-135-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3204-134-0x0000000000000000-mapping.dmp

Download
memory/3392-143-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/3392-144-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/3392-138-0x0000000000000000-mapping.dmp

Download
memory/3392-152-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/4292-145-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads