netwire | 29140d152decd019a1c0ceac94617dfcd04700db84a6711fca33ccb94039fbe5

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 03:16

Target

5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
Size

780KB
MD5

f4e294e4ff1d37874053074e502349ec
SHA1

ada0f22588448ffc218556ce12b045316d1ee418
SHA256

5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e
SHA512

c81582ce3119cc670f6092c82a525dc0fb9a4b68427646a7bc04fe0e0814845a82782c4284c5576453bc944f660778dc836d784d7f5fd780c56a101574cb0328
SSDEEP

3072:lD7fFC3Xi1NCvsHrryNyXtYUKucJcmGUcBCEHl5HHghiUjIyDvUmTncs4U+21s8D:lv06NIIKOm+YSHllAhxc2smYsvds8WC

Score

10^/10

Family

netwire

190.123.44.137:3369

Attributes

NetWire RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/2560-8-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral1/memory/2560-10-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral1/memory/2560-13-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral1/memory/2560-15-0x0000000000400000-0x0000000000420000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2484 set thread context of 2560	2484	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2484	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2484	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2560	2484	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	28
PID 2484 wrote to memory of 2560	2484	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	28
PID 2484 wrote to memory of 2560	2484	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	28
PID 2484 wrote to memory of 2560	2484	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	28
PID 2484 wrote to memory of 2560	2484	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	28
PID 2484 wrote to memory of 2560	2484	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	28
PID 2484 wrote to memory of 2560	2484	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	28
PID 2484 wrote to memory of 2560	2484	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	28
PID 2484 wrote to memory of 2560	2484	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	28

C:\Users\Admin\AppData\Local\Temp\5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
"C:\Users\Admin\AppData\Local\Temp\5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Users\Admin\AppData\Local\Temp\5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
  "C:\Users\Admin\AppData\Local\Temp\5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe"
  2⤵
  PID:2560

memory/2484-0-0x0000000074D41000-0x0000000074D42000-memory.dmp

Filesize
4KB

Download
memory/2484-1-0x0000000074D40000-0x00000000752EB000-memory.dmp

Filesize
5.7MB

Download
memory/2484-2-0x0000000074D40000-0x00000000752EB000-memory.dmp

Filesize
5.7MB

Download
memory/2484-3-0x0000000074D40000-0x00000000752EB000-memory.dmp

Filesize
5.7MB

Download
memory/2484-4-0x0000000074D40000-0x00000000752EB000-memory.dmp

Filesize
5.7MB

Download
memory/2484-5-0x0000000074D40000-0x00000000752EB000-memory.dmp

Filesize
5.7MB

Download
memory/2484-6-0x0000000074D40000-0x00000000752EB000-memory.dmp

Filesize
5.7MB

Download
memory/2484-14-0x0000000074D40000-0x00000000752EB000-memory.dmp

Filesize
5.7MB

Download
memory/2560-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2560-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2560-13-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2560-15-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download