netwire | 916b29893883170338ebfbfbfc0d6161fa262a7b6f13d6a8ad74c8a1cd46395f

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 01:29

Target

496472b169b3391d0ab74b4c0e90323b.exe
Size

547KB
MD5

496472b169b3391d0ab74b4c0e90323b
SHA1

6effc911e99f79f37f26fd362b863e6432ee3a17
SHA256

916b29893883170338ebfbfbfc0d6161fa262a7b6f13d6a8ad74c8a1cd46395f
SHA512

ccd2e576273e3df44c049b65c6b1b7948f142c5dc573b0f30b97c0f65e8e1d1c0ef7dfb5d581fd6dbc9e7f517b125fe72e771db3abaf77f869b997a854664c54
SSDEEP

12288:XfcLDGoTfMLiJOfjYcSauWQOuT4vRTqZ+740RWJ:0XvJOuaxQLqNqIRRWJ

Score

10^/10

Family

netwire

warin.hopto.org:4320

Attributes

NetWire RAT payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/2880-3-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/2880-5-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/2880-6-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2628 set thread context of 2880	2628	496472b169b3391d0ab74b4c0e90323b.exe	28

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2628	496472b169b3391d0ab74b4c0e90323b.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2880	2628	496472b169b3391d0ab74b4c0e90323b.exe	28
PID 2628 wrote to memory of 2880	2628	496472b169b3391d0ab74b4c0e90323b.exe	28
PID 2628 wrote to memory of 2880	2628	496472b169b3391d0ab74b4c0e90323b.exe	28
PID 2628 wrote to memory of 2880	2628	496472b169b3391d0ab74b4c0e90323b.exe	28
PID 2628 wrote to memory of 2880	2628	496472b169b3391d0ab74b4c0e90323b.exe	28

C:\Users\Admin\AppData\Local\Temp\496472b169b3391d0ab74b4c0e90323b.exe
"C:\Users\Admin\AppData\Local\Temp\496472b169b3391d0ab74b4c0e90323b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Users\Admin\AppData\Local\Temp\496472b169b3391d0ab74b4c0e90323b.exe
  "C:\Users\Admin\AppData\Local\Temp\496472b169b3391d0ab74b4c0e90323b.exe"
  2⤵
  PID:2880

memory/2628-1-0x0000000000090000-0x0000000000190000-memory.dmp

Filesize
1024KB

Download
memory/2628-2-0x00000000002F0000-0x00000000002F2000-memory.dmp

Filesize
8KB

Download
memory/2880-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2880-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2880-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download