netwire | 283e202b7318b5849abe2ad06a686dc226cdfe1383697e323eb04400075a9c09

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 11:55

Target

c88de0354b6f5f4ea3a22fb2faa80af6.exe
Size

384KB
MD5

c88de0354b6f5f4ea3a22fb2faa80af6
SHA1

3ab1996451c83e98ea9ab9222f50eb2c50f88f15
SHA256

283e202b7318b5849abe2ad06a686dc226cdfe1383697e323eb04400075a9c09
SHA512

3b727e8b60d47a82770e8d1deefe1b184f0382590b05c4bce539187301e2c3cb8624a6f15e60fe314f36c5ba7086a86dc60bedac71c420adcc3902747b3af355
SSDEEP

6144:ZD4vtzeFLGDFQqFedCM2rpZAD+iu189G9/9UWxdblnQ8:ZSelzr+ta4uWxdb9Q8

Score

10^/10

Family

netwire

warin.hopto.org:4320

Attributes

NetWire RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/3004-1-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/3004-4-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/3004-5-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/3004-6-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1368 set thread context of 3004	1368	c88de0354b6f5f4ea3a22fb2faa80af6.exe	29

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1368	c88de0354b6f5f4ea3a22fb2faa80af6.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 3004	1368	c88de0354b6f5f4ea3a22fb2faa80af6.exe	29
PID 1368 wrote to memory of 3004	1368	c88de0354b6f5f4ea3a22fb2faa80af6.exe	29
PID 1368 wrote to memory of 3004	1368	c88de0354b6f5f4ea3a22fb2faa80af6.exe	29
PID 1368 wrote to memory of 3004	1368	c88de0354b6f5f4ea3a22fb2faa80af6.exe	29
PID 1368 wrote to memory of 3004	1368	c88de0354b6f5f4ea3a22fb2faa80af6.exe	29

C:\Users\Admin\AppData\Local\Temp\c88de0354b6f5f4ea3a22fb2faa80af6.exe
"C:\Users\Admin\AppData\Local\Temp\c88de0354b6f5f4ea3a22fb2faa80af6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Users\Admin\AppData\Local\Temp\c88de0354b6f5f4ea3a22fb2faa80af6.exe
  "C:\Users\Admin\AppData\Local\Temp\c88de0354b6f5f4ea3a22fb2faa80af6.exe"
  2⤵
  PID:3004

memory/1368-2-0x0000000000090000-0x0000000000190000-memory.dmp

Filesize
1024KB

Download
memory/3004-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3004-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3004-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3004-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download