netwire | df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 18:07

Target

df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe
Size

532KB
MD5

41460312beebf82c6ec41c66668fe8ca
SHA1

63824b88debe7f4109d0c51a788ed11dfa913b6c
SHA256

df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a
SHA512

01181f26740ee6734e4aeba825ae3e1cef499d61dd8c48ab8a09fbfa257701e91e08cbe057dff3c44940abd105cc14a9d50ec4d85c12a6012b4c30a875586ba5
SSDEEP

6144:jas0n38fUMxMcnuBhP8fUMxMcnuBhP8fUMxMcnuBhP8fUMxMcnuBhPXukmxJUEMz:25duAE+P9OJBQ3IPmd5t3W7K

Score

10^/10

Family

netwire

204.152.219.82:9008

Attributes

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/692-140-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/692-139-0x0000000000400000-0x0000000000487000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

Processes:

df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe

description	pid	process	target process
PID 3968 set thread context of 692	3968	df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe	df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe

pid process

3968 df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe

pid	process
3968	df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe

description	pid	process	target process
PID 3968 wrote to memory of 692	3968	df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe	df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe
PID 3968 wrote to memory of 692	3968	df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe	df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe
PID 3968 wrote to memory of 692	3968	df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe	df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe

C:\Users\Admin\AppData\Local\Temp\df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe
"C:\Users\Admin\AppData\Local\Temp\df16c889e128e3c308328af7cfb8f888d1fd4cdd26de73fcf97491352c43813a.exe"
2⤵
PID:692

memory/692-135-0x0000000000000000-mapping.dmp

Download
memory/692-140-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/692-139-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/692-146-0x00007FF981CD0000-0x00007FF981EC5000-memory.dmp

Filesize
2.0MB

Download
memory/692-147-0x0000000077820000-0x00000000779C3000-memory.dmp

Filesize
1.6MB

Download
memory/692-148-0x00000000005A0000-0x00000000005A8000-memory.dmp

Filesize
32KB

Download
memory/3968-134-0x0000000002230000-0x0000000002238000-memory.dmp

Filesize
32KB

Download
memory/3968-136-0x0000000002230000-0x0000000002238000-memory.dmp

Filesize
32KB

Download
memory/3968-137-0x00007FF981CD0000-0x00007FF981EC5000-memory.dmp

Filesize
2.0MB

Download
memory/3968-138-0x0000000077820000-0x00000000779C3000-memory.dmp

Filesize
1.6MB

Download