netwire | 04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c

General

Target

04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe
Size

1.1MB
MD5

a4bbbf2b22423ae6b9702561b53bad2f
SHA1

386d9f411197cecf7ba9c94029e1035557d9f2a0
SHA256

04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c
SHA512

8c9d548137946b98ff2400e90fb9925156ed0047575e290c08ce9161fd25b955ffa344ab79f794ec696c67d8b9a26288848658eac5f48e85cbfbd900b0206cd7
SSDEEP

12288:rH7Wcjdc/r2sxxiPGGAOOPSXDV8ClgVYhX5FSsf8QrJIkBb9r+AzOcOJEbdOvc/2:rbCj2sObHtqQ4Q/OJtAZBjlpQ

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1340-60-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1340-62-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1340-63-0x00000000004021DA-mapping.dmp	netwire
behavioral1/memory/1340-66-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1340-67-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1340-68-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

Processes:

04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe

description	pid	process	target process
PID 1248 set thread context of 1340	1248	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe

pid	process
1248	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe
1248	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe

description	pid	process	target process
PID 1248 wrote to memory of 1340	1248	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe
PID 1248 wrote to memory of 1340	1248	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe
PID 1248 wrote to memory of 1340	1248	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe
PID 1248 wrote to memory of 1340	1248	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe
PID 1248 wrote to memory of 1340	1248	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe
PID 1248 wrote to memory of 1340	1248	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe
PID 1248 wrote to memory of 1340	1248	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe
PID 1248 wrote to memory of 1340	1248	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe
PID 1248 wrote to memory of 1340	1248	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe	04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe

C:\Users\Admin\AppData\Local\Temp\04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe
"C:\Users\Admin\AppData\Local\Temp\04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1248

C:\Users\Admin\AppData\Local\Temp\04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe
"C:\Users\Admin\AppData\Local\Temp\04835eb2437a23e0d6dbfcbd61aa942090c5255184a82550e67d15fa6d543b8c.exe"
2⤵
PID:1340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1248-54-0x00000000759C1000-0x00000000759C3000-memory.dmp

Filesize
8KB

Download
memory/1340-55-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1340-56-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1340-58-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1340-60-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1340-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1340-63-0x00000000004021DA-mapping.dmp

Download
memory/1340-66-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1340-67-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1340-68-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads