netwire | 2f4f1c4a65cc5dc139ee1e7bb278b90864a0df4a7bfe0bc6c5247f445792d606

Analysis

max time kernel
141s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
Size 1.1MB
Sample240402-qjd8labd29
SHA256 1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06
MD5 9c6d1aca02db373a52401485c376d87e
SHA1 9cc4435729a11d7c524d761b67de508b4474b206
SHA512 9f4aaadf939a97e2354f18ef1943594edf2c6eb04852e4fecc68ff1eeee9146ff1ec1ac26191f8c9435e39b765da23f14aa835313de670d3235e6b4eb890955d
SSDEEP 24576:iCdxte/80jYLT3U1jfsWa/69ryeoEuGfYsoRzDQ:zw80cTsjkWa/FR4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

halwachi50.mymediapc.net:5868

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
true
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/1360-0-0x0000000000160000-0x000000000018C000-memory.dmp	netwire
behavioral2/memory/1360-10-0x0000000000160000-0x000000000018C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Executes dropped EXE 1 IoCs

pid	Process
1456	Host.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000300000000070b-13.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4216 set thread context of 1360	4216	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe	97

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4216	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
4216	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
4216	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
4216	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
1456	Host.exe
1456	Host.exe
1456	Host.exe
1456	Host.exe
1456	Host.exe
1456	Host.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4216	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
4216	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
4216	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
1456	Host.exe
1456	Host.exe
1456	Host.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
4216	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
4216	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
4216	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
1456	Host.exe
1456	Host.exe
1456	Host.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 1360	4216	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe	97
PID 4216 wrote to memory of 1360	4216	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe	97
PID 4216 wrote to memory of 1360	4216	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe	97
PID 4216 wrote to memory of 1360	4216	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe	97
PID 4216 wrote to memory of 1360	4216	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe	97
PID 1360 wrote to memory of 1456	1360	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe	98
PID 1360 wrote to memory of 1456	1360	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe	98
PID 1360 wrote to memory of 1456	1360	1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe	98

C:\Users\Admin\AppData\Local\Temp\1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
"C:\Users\Admin\AppData\Local\Temp\1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Users\Admin\AppData\Local\Temp\1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe
  "C:\Users\Admin\AppData\Local\Temp\1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Users\Admin\AppData\Roaming\Install\Host.exe
    "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Host.exe

Path C:\Users\Admin\AppData\Roaming\Install\Host.exe
Size 1.1MB
SHA256 1a2c28a7682c26ddb97885fc056dc72b2c2df437c5fa3031226e34775095df06
MD5 9c6d1aca02db373a52401485c376d87e
SHA1 9cc4435729a11d7c524d761b67de508b4474b206
SHA512 9f4aaadf939a97e2354f18ef1943594edf2c6eb04852e4fecc68ff1eeee9146ff1ec1ac26191f8c9435e39b765da23f14aa835313de670d3235e6b4eb890955d
SSDEEP 24576:iCdxte/80jYLT3U1jfsWa/69ryeoEuGfYsoRzDQ:zw80cTsjkWa/FR4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1360-0-0x0000000000160000-0x000000000018C000-memory.dmp

Download

memory/1360-10-0x0000000000160000-0x000000000018C000-memory.dmp

Download

memory/4216-2-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download