netwire | 6e318257ff61f8aeff03704c59af6d66f52b4ae7fe36ab8b715db00694cad13a

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 20:31

Target

0332c0b39be14a0fbfbb0689bdd2027d.exe
Size

530KB
MD5

0332c0b39be14a0fbfbb0689bdd2027d
SHA1

cc98db2d9f83f7a7685219808ae9ae5414110747
SHA256

6e318257ff61f8aeff03704c59af6d66f52b4ae7fe36ab8b715db00694cad13a
SHA512

fd06c301590a05cb26c0026ce2a3f560a345cc2e63f563fe6958db48513994550e5f25d54f312be3c108c96645cf7cc41448fc5b05ca7a57aa15cfc6768b0a55
SSDEEP

6144:3FX9qqKGPBcwqh3SBL2S/93+RosoV9cVGP0mnGF1Q5QDNWmuSYNKFpqrT5phv:3ivGPOEv3+RRe9cVXbqyDNtIrbd

Score

10^/10

Family

netwire

warin.hopto.org:4320

Attributes

NetWire RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/624-3-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/624-5-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/624-6-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/624-7-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2008 set thread context of 624	2008	0332c0b39be14a0fbfbb0689bdd2027d.exe	91

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2008	0332c0b39be14a0fbfbb0689bdd2027d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 624	2008	0332c0b39be14a0fbfbb0689bdd2027d.exe	91
PID 2008 wrote to memory of 624	2008	0332c0b39be14a0fbfbb0689bdd2027d.exe	91
PID 2008 wrote to memory of 624	2008	0332c0b39be14a0fbfbb0689bdd2027d.exe	91
PID 2008 wrote to memory of 624	2008	0332c0b39be14a0fbfbb0689bdd2027d.exe	91

C:\Users\Admin\AppData\Local\Temp\0332c0b39be14a0fbfbb0689bdd2027d.exe
"C:\Users\Admin\AppData\Local\Temp\0332c0b39be14a0fbfbb0689bdd2027d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Local\Temp\0332c0b39be14a0fbfbb0689bdd2027d.exe
  "C:\Users\Admin\AppData\Local\Temp\0332c0b39be14a0fbfbb0689bdd2027d.exe"
  2⤵
  PID:624

memory/624-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/624-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/624-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/624-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2008-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

Filesize
1024KB

Download
memory/2008-2-0x0000000003840000-0x0000000003842000-memory.dmp

Filesize
8KB

Download