netwire | 6e318257ff61f8aeff03704c59af6d66f52b4ae7fe36ab8b715db00694cad13a

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:30

Target

0332c0b39be14a0fbfbb0689bdd2027d.exe
Size

530KB
MD5

0332c0b39be14a0fbfbb0689bdd2027d
SHA1

cc98db2d9f83f7a7685219808ae9ae5414110747
SHA256

6e318257ff61f8aeff03704c59af6d66f52b4ae7fe36ab8b715db00694cad13a
SHA512

fd06c301590a05cb26c0026ce2a3f560a345cc2e63f563fe6958db48513994550e5f25d54f312be3c108c96645cf7cc41448fc5b05ca7a57aa15cfc6768b0a55
SSDEEP

6144:3FX9qqKGPBcwqh3SBL2S/93+RosoV9cVGP0mnGF1Q5QDNWmuSYNKFpqrT5phv:3ivGPOEv3+RRe9cVXbqyDNtIrbd

Score

10^/10

Family

netwire

warin.hopto.org:4320

Attributes

NetWire RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/320-6-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/320-5-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/320-3-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/320-7-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1404 set thread context of 320	1404	0332c0b39be14a0fbfbb0689bdd2027d.exe	17

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1404	0332c0b39be14a0fbfbb0689bdd2027d.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 320	1404	0332c0b39be14a0fbfbb0689bdd2027d.exe	17
PID 1404 wrote to memory of 320	1404	0332c0b39be14a0fbfbb0689bdd2027d.exe	17
PID 1404 wrote to memory of 320	1404	0332c0b39be14a0fbfbb0689bdd2027d.exe	17
PID 1404 wrote to memory of 320	1404	0332c0b39be14a0fbfbb0689bdd2027d.exe	17
PID 1404 wrote to memory of 320	1404	0332c0b39be14a0fbfbb0689bdd2027d.exe	17

C:\Users\Admin\AppData\Local\Temp\0332c0b39be14a0fbfbb0689bdd2027d.exe
"C:\Users\Admin\AppData\Local\Temp\0332c0b39be14a0fbfbb0689bdd2027d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Users\Admin\AppData\Local\Temp\0332c0b39be14a0fbfbb0689bdd2027d.exe
  "C:\Users\Admin\AppData\Local\Temp\0332c0b39be14a0fbfbb0689bdd2027d.exe"
  2⤵
  PID:320

memory/320-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/320-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/320-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/320-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1404-2-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/1404-1-0x0000000000090000-0x0000000000190000-memory.dmp

Filesize
1024KB

Download