netwire | df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a

Analysis

max time kernel
117s
max time network
130s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 18:07

Target

df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe
Size

532KB
MD5

41460312beebf82c6ec41c66668fe8ca
SHA1

63824b88debe7f4109d0c51a788ed11dfa913b6c
SHA256

df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a
SHA512

01181f26740ee6734e4aeba825ae3e1cef499d61dd8c48ab8a09fbfa257701e91e08cbe057dff3c44940abd105cc14a9d50ec4d85c12a6012b4c30a875586ba5
SSDEEP

6144:jas0n38fUMxMcnuBhP8fUMxMcnuBhP8fUMxMcnuBhP8fUMxMcnuBhPXukmxJUEMz:25duAE+P9OJBQ3IPmd5t3W7K

Score

10^/10

Family

netwire

204.152.219.82:9008

Attributes

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/884-64-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/884-63-0x0000000000400000-0x0000000000487000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

Processes:

df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe

description	pid	process	target process
PID 1392 set thread context of 884	1392	df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe	df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe

pid process

1392 df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe

pid	process
1392	df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe

description	pid	process	target process
PID 1392 wrote to memory of 884	1392	df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe	df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe
PID 1392 wrote to memory of 884	1392	df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe	df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe
PID 1392 wrote to memory of 884	1392	df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe	df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe
PID 1392 wrote to memory of 884	1392	df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe	df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe

C:\Users\Admin\AppData\Local\Temp\df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe
"C:\Users\Admin\AppData\Local\Temp\df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe"
2⤵
PID:884

memory/884-58-0x0000000000477701-mapping.dmp

Download
memory/884-64-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/884-63-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/884-70-0x0000000077200000-0x00000000773A9000-memory.dmp

Filesize
1.7MB

Download
memory/884-71-0x00000000773E0000-0x0000000077560000-memory.dmp

Filesize
1.5MB

Download
memory/884-72-0x0000000000260000-0x0000000000268000-memory.dmp

Filesize
32KB

Download
memory/1392-56-0x00000000002C0000-0x00000000002C8000-memory.dmp

Filesize
32KB

Download
memory/1392-57-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/1392-59-0x00000000002C0000-0x00000000002C8000-memory.dmp

Filesize
32KB

Download
memory/1392-60-0x0000000077200000-0x00000000773A9000-memory.dmp

Filesize
1.7MB

Download
memory/1392-61-0x00000000773E0000-0x0000000077560000-memory.dmp

Filesize
1.5MB

Download