netwire | 63b408d9416dc9d3c2c4fc8aa11100e5c58a5faf44d210229b867f12d0ce9c02

Analysis

max time kernel
289s
max time network
284s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-02-2023 03:10

Target

unk.exe
Size

910KB
MD5

c7331f4c14752e3fb6bdf174395de01b
SHA1

097c79ecbb662e332a490b63cd2a497464afa1a2
SHA256

63b408d9416dc9d3c2c4fc8aa11100e5c58a5faf44d210229b867f12d0ce9c02
SHA512

a236c11638434438baeb2c9ebc12ec4c1dc19dbcc9e6aac91ba487e8035a2c8c0cba8af4878c98a45983a8ed9f578a1500357611854c83fa51ac8ac6633fe11f
SSDEEP

24576:MA3jbtIYqWkWyt5lt+8v50tFA4MLrxN5IC54TWMt:rTrqWkWktrGtFA4Wtgi

Score

10^/10

Family

netwire

69.174.98.165:3369

Attributes

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1876-138-0x0000000000400000-0x000000000044F000-memory.dmp	netwire
behavioral2/memory/1876-139-0x0000000000400000-0x000000000044F000-memory.dmp	netwire
behavioral2/memory/1876-140-0x0000000000400000-0x000000000044F000-memory.dmp	netwire
behavioral2/memory/1876-141-0x0000000000400000-0x000000000044F000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

unk.exe

description pid process target process

PID 4280 set thread context of 1876 4280 unk.exe unk.exe

description	pid	process	target process
PID 4280 set thread context of 1876	4280	unk.exe	unk.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

unk.exe

description	pid	process	target process
PID 4280 wrote to memory of 1876	4280	unk.exe	unk.exe
PID 4280 wrote to memory of 1876	4280	unk.exe	unk.exe
PID 4280 wrote to memory of 1876	4280	unk.exe	unk.exe
PID 4280 wrote to memory of 1876	4280	unk.exe	unk.exe
PID 4280 wrote to memory of 1876	4280	unk.exe	unk.exe
PID 4280 wrote to memory of 1876	4280	unk.exe	unk.exe
PID 4280 wrote to memory of 1876	4280	unk.exe	unk.exe
PID 4280 wrote to memory of 1876	4280	unk.exe	unk.exe
PID 4280 wrote to memory of 1876	4280	unk.exe	unk.exe
PID 4280 wrote to memory of 1876	4280	unk.exe	unk.exe

C:\Users\Admin\AppData\Local\Temp\unk.exe
"C:\Users\Admin\AppData\Local\Temp\unk.exe"
2⤵
PID:1876

memory/1876-137-0x0000000000000000-mapping.dmp

Download
memory/1876-138-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1876-139-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1876-140-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1876-141-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4280-132-0x0000000000B70000-0x0000000000C58000-memory.dmp

Filesize
928KB

Download
memory/4280-133-0x0000000005AD0000-0x0000000006074000-memory.dmp

Filesize
5.6MB

Download
memory/4280-134-0x0000000005600000-0x0000000005692000-memory.dmp

Filesize
584KB

Download
memory/4280-135-0x00000000057A0000-0x00000000057AA000-memory.dmp

Filesize
40KB

Download
memory/4280-136-0x0000000009370000-0x000000000940C000-memory.dmp

Filesize
624KB

Download