netwire | e49a3e956dc1299041ed6f3c8a80a444f1e7f82a09bdb5044306a5e924818f43

Analysis

max time kernel
149s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/05/2026, 19:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpsw0a9gwv.exe
Size 181KB
Sample260524-yjn2sshx81
SHA256 e49a3e956dc1299041ed6f3c8a80a444f1e7f82a09bdb5044306a5e924818f43
MD5 0c836cda6823cc0b4b77008312e9720c
SHA1 cca0f066989f5c990a40772221156abec9f6858c
SHA512 cc54afec9c829b7e9f282323707712faecfafee6639c50ebfc40da4407d3ebb070918618115828916cc6f67b9928340c177ee41b4bec5a9a529c7de9cbca61cb
SSDEEP 3072:mTXJxJqD0RVbkoh6tafBJd6crswsF05u46xpMigkdIZ2T8UCEU:Kw0RVIAAa5n6aswsF0MxlgqDTtCf
TLSH
T13204CE14F1ED911EF663BBB12BCB54DD9C9AFA72E60269E63382130E4950FC0DD1163A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet discovery netwire rat stealer

Malware Config

Extracted

Family

netwire

snoopdmoney2018.sytes.net:3864
snoopdmoneybkup.sytes.net:3864

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
hfqIXkNC
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
true

Signatures

Family: Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

NetWire RAT payload 6 IoCs

rat

resource	yara_rule
behavioral1/memory/4896-21-0x0000000005720000-0x000000000574C000-memory.dmp	netwire
behavioral1/memory/2784-23-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/2784-26-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/2784-27-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/2784-28-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/2784-35-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fBKDCV.url	tmpsw0a9gwv.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4896 set thread context of 2784	4896	tmpsw0a9gwv.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpsw0a9gwv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4896	tmpsw0a9gwv.exe
4896	tmpsw0a9gwv.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4896	tmpsw0a9gwv.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 704	4896	tmpsw0a9gwv.exe	83
PID 704 wrote to memory of 940	704	csc.exe	85
PID 4896 wrote to memory of 2784	4896	tmpsw0a9gwv.exe	86
PID 4896 wrote to memory of 2784	4896	tmpsw0a9gwv.exe	86
PID 4896 wrote to memory of 2784	4896	tmpsw0a9gwv.exe	86
PID 4896 wrote to memory of 2784	4896	tmpsw0a9gwv.exe	86
PID 4896 wrote to memory of 2784	4896	tmpsw0a9gwv.exe	86
PID 4896 wrote to memory of 2784	4896	tmpsw0a9gwv.exe	86
PID 4896 wrote to memory of 2784	4896	tmpsw0a9gwv.exe	86

C:\Users\Admin\AppData\Local\Temp\tmpsw0a9gwv.exe
"C:\Users\Admin\AppData\Local\Temp\tmpsw0a9gwv.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\be2sczxj\be2sczxj.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3F17.tmp" "c:\Users\Admin\AppData\Local\Temp\be2sczxj\CSC1D58F8F9305D424C8ECE275AA8808EA0.TMP"
    3⤵
    PID:940
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  PID:2784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES3F17.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3F17.tmp
Size 1KB
SHA256 ed7cc019c40f63c0b6bdcb4f596aa02a07ac4e7b2b0de50581f4bbaac1065853
MD5 4cac3d95a67be82376c8db0364286488
SHA1 6485d59f92ce4cabcf06b0a5e1278ff3d1873fbc
SHA512 bcbbe31dca73cf6051ccdec082cef638fd5b235c4b0405639f2efd11f356cb356c4aa7858cdc6ce6e6c3b42d4cf61e5389ec6eaca54ffb48cb0232eac1772460
TLSH
T104414F0083D88B0BF17243317DF7472AA678BE56AFAA475E7584412E1F02740ED936B1
MD5 SHA1 SHA512 TLSH

Submit Download

be2sczxj.dll

Path C:\Users\Admin\AppData\Local\Temp\be2sczxj\be2sczxj.dll
Size 7KB
SHA256 57cdd9c192e576911a2e88b7c67892819ac8e38f3a5afd104f39b5e1e947eeed
MD5 a8b74719ce6528c426d90da3d755c2e5
SHA1 7d977c6d3ef8baa77c079372dff20274ebe6dee6
SHA512 4649d7b029bdd17c58520709e1ce8290189dc4061a80f7bee6929ae30d0b0a0f224f281eff844d4f9ecbfa064f07781d487803ef2b093b344be5f82d82176c76
SSDEEP 96:ieUcuEMZkTeIfs263/u0PidWwjXGWv7+kldjwWSsaEKgH2tK9zNt:ieUcuZ3upUwDFERENh3
TLSH
T188F1D74B97994A1DE97E07747C7343106FB1D6598EA3A79E1DCC00683FA23906813BB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be2sczxj.pdb

Path C:\Users\Admin\AppData\Local\Temp\be2sczxj\be2sczxj.pdb
Size 23KB
SHA256 97c9f2ce8b211f12230bc82f7ce9a0779dd9c9deccd913f686556ae8cbc7b1d9
MD5 43122d36e5b43ad936af96d835fe4741
SHA1 afdef6aa66abb49bdf95935c33cd176d3aa34b38
SHA512 93b0f2aad81cc880bc9e017b23aaf4c9444a4af072ce9477fc8142c239a673bdee82d8adddf29f0927845def56f359175a2b9770dd73108d48f75e5c739eeadb
SSDEEP 192:gAFVCXaa18nmcyT3jVpAc6jT1lSFjdulvbXusbKWIYnnTllrpqH:DCR16UjHchE
TLSH
T157B2CF137B81DA33C4568A3C6AAB8F1D4374FC885F87A35B6752B22D3EF23991D91250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC1D58F8F9305D424C8ECE275AA8808EA0.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\be2sczxj\CSC1D58F8F9305D424C8ECE275AA8808EA0.TMP
Size 1KB
SHA256 8ff5332f2f35eb94ba3fc2092250cce066bfe469248ce0d6a1d5e6d842675096
MD5 4bc24147539f0e3fd472c2d818de85c1
SHA1 7c437b04993b85abf77e423260749f057dbd9e08
SHA512 ee9100607d6e97791d6a7667c084e83b1e8591bfa1af5a36d5a71054d1a3935a737b2fc0f61ccbea817163524c8a18a30f4c3358f01daacf743dce4f8ba9b9d8
TLSH
T18521AB45A3E8820EF1B387707EF2836392A8BE669D7943EC34C8135F6F1594089936B1
MD5 SHA1 SHA512 TLSH

Submit Download

be2sczxj.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\be2sczxj\be2sczxj.0.cs
Size 5KB
SHA256 7dbc8e65af713107b3c6dabbe54fa6f8d96a2523f695aba89bc6a0a21f0c7930
MD5 8bd152b7219f148baf07dc977f925f4a
SHA1 aa4af14f9fc1887ea07d9b24852e3631a18e7273
SHA512 4824d91fcf8784eeb004589086b557840ba2cd4ab1e8e6a287cf0ad187891adbd57227e16097231b59fb1820991e276114403524123d8cad1b8c629b44caf5d5
SSDEEP 96:JoUX1V01ziqWJ2HsfVGvcGtT/KKmUlhYu99tZHVbjEXGJ993OKy:N6iyM4vcGF/Xlhxf1bj/93Ty
TLSH
T14BC166012F19C579257B210585B1885BFE37663317FD7818F9CF01A54FB252983B9EA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be2sczxj.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\be2sczxj\be2sczxj.cmdline
Size 312B
SHA256 ecf182a2236c793d8c7ff098aa82efe377894ddf2e6d20f404352bafff054ed5
MD5 52ff18a8cdbd6d55432f1b29d287f3f6
SHA1 f7b0ab435d14b6959a1119270d497a28bea7dc46
SHA512 5463e3b45f53e0d1e6c541c7374a1437d9cb492c12986d07b57bd3760f3ec85b8f93842bb8fc946d295433681a09811e8dd1b8ab2e7d495ed0dac6e7f021fd78
TLSH
T16EE0863A4396DF6C92B8104750E1C9EC42B20F2739256E949AA0844C477B44577B1B63
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2784-23-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2784-35-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2784-28-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2784-27-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2784-26-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4896-16-0x0000000002DA0000-0x0000000002DA8000-memory.dmp

Download

memory/4896-21-0x0000000005720000-0x000000000574C000-memory.dmp

Download

memory/4896-22-0x0000000005BD0000-0x0000000005C6C000-memory.dmp

Download

memory/4896-19-0x0000000005470000-0x000000000547C000-memory.dmp

Download

memory/4896-18-0x00000000055C0000-0x00000000055F2000-memory.dmp

Download

memory/4896-17-0x0000000005480000-0x0000000005512000-memory.dmp

Download

memory/4896-0-0x0000000000BC0000-0x0000000000BF2000-memory.dmp

Download

memory/4896-1-0x0000000005540000-0x0000000005550000-memory.dmp

Download