netwire | c0f250cedac49488822f0cf7eff17dea2a0c41be568cb073c13064a9b9e73e4f

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 20:50

Target

757dda6feff31225fd5bcdd9a2216a4a.exe
Size

721KB
MD5

757dda6feff31225fd5bcdd9a2216a4a
SHA1

7e91d879def296d13e4429f9f780acfb12469089
SHA256

c0f250cedac49488822f0cf7eff17dea2a0c41be568cb073c13064a9b9e73e4f
SHA512

8a9f9c67f067211e5ed5bf409678ca00b4d41ff976d23f1d173a496a837f3892f07836d5b1dcb0bd1e86cfb4a7a4c94b1ffd4aad22ba2bc0475f91592b1cfcb6
SSDEEP

12288:6g8tD+p1h79i/DdVedE5fJD7uwkQdBSAeEflPXuvXcVY1n32lx:6gwVDdcE5fJh3rfFuPce1n3ex

Score

10^/10

Family

netwire

warin.hopto.org:4320

Attributes

NetWire RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/2308-2-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/2308-5-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/2308-6-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/2308-7-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4816 set thread context of 2308	4816	757dda6feff31225fd5bcdd9a2216a4a.exe	89

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4816	757dda6feff31225fd5bcdd9a2216a4a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 2308	4816	757dda6feff31225fd5bcdd9a2216a4a.exe	89
PID 4816 wrote to memory of 2308	4816	757dda6feff31225fd5bcdd9a2216a4a.exe	89
PID 4816 wrote to memory of 2308	4816	757dda6feff31225fd5bcdd9a2216a4a.exe	89
PID 4816 wrote to memory of 2308	4816	757dda6feff31225fd5bcdd9a2216a4a.exe	89

C:\Users\Admin\AppData\Local\Temp\757dda6feff31225fd5bcdd9a2216a4a.exe
"C:\Users\Admin\AppData\Local\Temp\757dda6feff31225fd5bcdd9a2216a4a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Users\Admin\AppData\Local\Temp\757dda6feff31225fd5bcdd9a2216a4a.exe
  "C:\Users\Admin\AppData\Local\Temp\757dda6feff31225fd5bcdd9a2216a4a.exe"
  2⤵
  PID:2308

memory/2308-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2308-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2308-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2308-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4816-0-0x0000000000980000-0x0000000000A02000-memory.dmp

Filesize
520KB

Download
memory/4816-1-0x000000000ED10000-0x000000000ED12000-memory.dmp

Filesize
8KB

Download
memory/4816-4-0x0000000000980000-0x0000000000A02000-memory.dmp

Filesize
520KB

Download