netwire | 97c0e937689f7ccf2ff6e468c1df802df5f22a76c672f544555b01b7e6d7aa42

Analysis

max time kernel
146s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
Size

432KB
MD5

9b07a0fdaa64049e857b3982eeb3a575
SHA1

63d7d2eefd78ee4736243c8e32c305366603c579
SHA256

d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b
SHA512

49db3c66ee829534937ba0cc8f62f568cc04891b141e402d5c2c7961335efbd453f33bc57b218f9cf609b4a665df4b31810d4215d6e994c03934264b184c770a
SSDEEP

6144:SPn3xY3d6ND9D/S4mAC09X1Qd6pOzWqGLDUz7j42W3Llin:SLNoS1Y6pq1AUvjW3Un

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

forgiveme.workisboring.com:3360

Attributes

activex_autorun
true
activex_key
{TN38RH36-U670-03U7-57DE-24XMTWQBHGH1}
copy_executable
true
delete_original
false
host_id
bendal
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Password
registry_autorun
true
startup_name
centosffjk
use_mutex
false

Signatures

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/2192-8-0x0000000000400000-0x0000000000470000-memory.dmp	netwire
behavioral2/memory/2192-16-0x0000000000400000-0x0000000000470000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Executes dropped EXE 1 IoCs

pid	Process
1056	Host.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
1056	Host.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1056	2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe	117
PID 2192 wrote to memory of 1056	2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe	117
PID 2192 wrote to memory of 1056	2192	d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe	117

C:\Users\Admin\AppData\Local\Temp\d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe
"C:\Users\Admin\AppData\Local\Temp\d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Roaming\Install\Host.exe
  "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1312 --field-trial-handle=2260,i,4762972005863767630,9297428255150568035,262144 --variations-seed-version /prefetch:8
1⤵
PID:1732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
432KB

MD5
9b07a0fdaa64049e857b3982eeb3a575

SHA1
63d7d2eefd78ee4736243c8e32c305366603c579

SHA256
d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b

SHA512
49db3c66ee829534937ba0cc8f62f568cc04891b141e402d5c2c7961335efbd453f33bc57b218f9cf609b4a665df4b31810d4215d6e994c03934264b184c770a

Download Submit
memory/2192-9-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/2192-7-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/2192-4-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/2192-6-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/2192-5-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/2192-0-0x0000000000560000-0x000000000059A000-memory.dmp

Filesize
232KB

Download
memory/2192-8-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2192-2-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/2192-3-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/2192-11-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/2192-13-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/2192-1-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/2192-18-0x0000000000560000-0x000000000059A000-memory.dmp

Filesize
232KB

Download
memory/2192-16-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download