netwire | 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e

Analysis

max time kernel
141s
max time network
145s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 14:28

Target

New Order14112016‮gpj.exe
Size

780KB
MD5

f4e294e4ff1d37874053074e502349ec
SHA1

ada0f22588448ffc218556ce12b045316d1ee418
SHA256

5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e
SHA512

c81582ce3119cc670f6092c82a525dc0fb9a4b68427646a7bc04fe0e0814845a82782c4284c5576453bc944f660778dc836d784d7f5fd780c56a101574cb0328
SSDEEP

3072:lD7fFC3Xi1NCvsHrryNyXtYUKucJcmGUcBCEHl5HHghiUjIyDvUmTncs4U+21s8D:lv06NIIKOm+YSHllAhxc2smYsvds8WC

Score

10^/10

Family

netwire

190.123.44.137:3369

Attributes

NetWire RAT payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/2640-8-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral1/memory/2640-9-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral1/memory/2640-13-0x0000000000400000-0x0000000000420000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2284 set thread context of 2640	2284	New Order14112016‮gpj.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2284	New Order14112016‮gpj.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2284	New Order14112016‮gpj.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2640	2284	New Order14112016‮gpj.exe	28
PID 2284 wrote to memory of 2640	2284	New Order14112016‮gpj.exe	28
PID 2284 wrote to memory of 2640	2284	New Order14112016‮gpj.exe	28
PID 2284 wrote to memory of 2640	2284	New Order14112016‮gpj.exe	28
PID 2284 wrote to memory of 2640	2284	New Order14112016‮gpj.exe	28
PID 2284 wrote to memory of 2640	2284	New Order14112016‮gpj.exe	28
PID 2284 wrote to memory of 2640	2284	New Order14112016‮gpj.exe	28
PID 2284 wrote to memory of 2640	2284	New Order14112016‮gpj.exe	28
PID 2284 wrote to memory of 2640	2284	New Order14112016‮gpj.exe	28

C:\Users\Admin\AppData\Local\Temp\New Order14112016‮gpj.exe
"C:\Users\Admin\AppData\Local\Temp\New Order14112016‮gpj.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Users\Admin\AppData\Local\Temp\New Order14112016‮gpj.exe
  "C:\Users\Admin\AppData\Local\Temp\New Order14112016‮gpj.exe"
  2⤵
  PID:2640

memory/2284-0-0x0000000074411000-0x0000000074412000-memory.dmp

Filesize
4KB

Download
memory/2284-1-0x0000000074410000-0x00000000749BB000-memory.dmp

Filesize
5.7MB

Download
memory/2284-2-0x0000000074410000-0x00000000749BB000-memory.dmp

Filesize
5.7MB

Download
memory/2284-3-0x0000000074410000-0x00000000749BB000-memory.dmp

Filesize
5.7MB

Download
memory/2284-4-0x0000000074410000-0x00000000749BB000-memory.dmp

Filesize
5.7MB

Download
memory/2284-5-0x0000000074410000-0x00000000749BB000-memory.dmp

Filesize
5.7MB

Download
memory/2284-10-0x0000000074410000-0x00000000749BB000-memory.dmp

Filesize
5.7MB

Download
memory/2640-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2640-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2640-13-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download