netwire | e49a3e956dc1299041ed6f3c8a80a444f1e7f82a09bdb5044306a5e924818f43

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/05/2026, 19:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpsw0a9gwv.exe
Size 181KB
Sample260524-yjn2sshx81
SHA256 e49a3e956dc1299041ed6f3c8a80a444f1e7f82a09bdb5044306a5e924818f43
MD5 0c836cda6823cc0b4b77008312e9720c
SHA1 cca0f066989f5c990a40772221156abec9f6858c
SHA512 cc54afec9c829b7e9f282323707712faecfafee6639c50ebfc40da4407d3ebb070918618115828916cc6f67b9928340c177ee41b4bec5a9a529c7de9cbca61cb
SSDEEP 3072:mTXJxJqD0RVbkoh6tafBJd6crswsF05u46xpMigkdIZ2T8UCEU:Kw0RVIAAa5n6aswsF0MxlgqDTtCf
TLSH
T13204CE14F1ED911EF663BBB12BCB54DD9C9AFA72E60269E63382130E4950FC0DD1163A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet discovery netwire rat stealer

Malware Config

Extracted

Family

netwire

snoopdmoney2018.sytes.net:3864
snoopdmoneybkup.sytes.net:3864

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
hfqIXkNC
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
true

Signatures

Family: Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

NetWire RAT payload 6 IoCs

rat

resource	yara_rule
behavioral2/memory/5416-22-0x0000000005440000-0x000000000546C000-memory.dmp	netwire
behavioral2/memory/2856-24-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/2856-27-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/2856-28-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/2856-30-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/2856-37-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fBKDCV.url	tmpsw0a9gwv.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5416 set thread context of 2856	5416	tmpsw0a9gwv.exe	93

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpsw0a9gwv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5416	tmpsw0a9gwv.exe
5416	tmpsw0a9gwv.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5416	tmpsw0a9gwv.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5416 wrote to memory of 4688	5416	tmpsw0a9gwv.exe	88
PID 4688 wrote to memory of 828	4688	csc.exe	92
PID 5416 wrote to memory of 2856	5416	tmpsw0a9gwv.exe	93
PID 5416 wrote to memory of 2856	5416	tmpsw0a9gwv.exe	93
PID 5416 wrote to memory of 2856	5416	tmpsw0a9gwv.exe	93
PID 5416 wrote to memory of 2856	5416	tmpsw0a9gwv.exe	93
PID 5416 wrote to memory of 2856	5416	tmpsw0a9gwv.exe	93
PID 5416 wrote to memory of 2856	5416	tmpsw0a9gwv.exe	93
PID 5416 wrote to memory of 2856	5416	tmpsw0a9gwv.exe	93

C:\Users\Admin\AppData\Local\Temp\tmpsw0a9gwv.exe
"C:\Users\Admin\AppData\Local\Temp\tmpsw0a9gwv.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5416
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0tgmgxz0\0tgmgxz0.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEDD6.tmp" "c:\Users\Admin\AppData\Local\Temp\0tgmgxz0\CSCC8CDEF0F5B7246B3A56F95EB15DC72CD.TMP"
    3⤵
    PID:828
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  PID:2856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0tgmgxz0.dll

Path C:\Users\Admin\AppData\Local\Temp\0tgmgxz0\0tgmgxz0.dll
Size 7KB
SHA256 bb7678ea2f45d4cf92a988452a64226dc40c8f4d60c5f4bb4592c5c1c06dd6e0
MD5 9a1244d1e070426cc331df77babf500b
SHA1 b21d931cab1bf4981bdbd23377407a8a7b84306b
SHA512 bb6cd16bff01a3ae3de252be5c3cd3827036c48e74cf9b2456b8842ce8dbc894f689dedb8d2a8a4e1b5fca6fc1573cd32d328f2d7dbdcde4e0963b628de39b25
SSDEEP 96:ieUcuEMZkTeIfs263/u0PidWwjXGWv7+kldjsSSsaEbgfqzK3zNt:ieUcuZ3upUwDFYVEkDh
TLSH
T117F1C74B97994A1DE96E07746C7383106FB1D6594EA3E79E1DC800783FA23906813BF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0tgmgxz0.pdb

Path C:\Users\Admin\AppData\Local\Temp\0tgmgxz0\0tgmgxz0.pdb
Size 23KB
SHA256 51002c9ca96916c37b2062053e05c31facdbf54a0ccbfa2053edcb5b19cefb28
MD5 35eb51aee28df25cdc9aa8871f4c0c90
SHA1 4eac6c26b958bdbc29e98c5354255be6eb83ac50
SHA512 2e56e91d18029648290e759db3f3aa9b3dd281e0f0e867bd7ab449474e8eb11996439077a22cb311fdd69b4c86f1bb385416a619b841f12e9eae05180ba0e9df
SSDEEP 192:EAF4CXaRo8nm2yTljVpAc6jT1lSFjdulvbXusbKWIYnnT6lENqH:2CmoUejHHuI
TLSH
T148B2DC537B80DA32C8568A3C6EAB8F1D4374FC885F87A31B5392B22D3DF23991D80650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESEDD6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEDD6.tmp
Size 1KB
SHA256 d6d4bd53c551dde55f0ccde161b8b2c33ac3d1ead2ab437bcb10a62a484781fa
MD5 fc77bd97174ca6344c86fac4593160f2
SHA1 bb820fe8d209047f21e67cabf2c574767b24e585
SHA512 7692a9ffdeb82fb5eb5159b84dccd9036a70a7b79cc3953301c5c40f387890de94c5c81e2c7b05d47e5dd93049f5b35662a18ee7901285c9f0ea625dd5bea32c
TLSH
T15D41310183D88B1EF17203312DF7972BA278FE56AFA9835EB584523E1E02744DD836B1
MD5 SHA1 SHA512 TLSH

Submit Download

0tgmgxz0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\0tgmgxz0\0tgmgxz0.0.cs
Size 5KB
SHA256 7dbc8e65af713107b3c6dabbe54fa6f8d96a2523f695aba89bc6a0a21f0c7930
MD5 8bd152b7219f148baf07dc977f925f4a
SHA1 aa4af14f9fc1887ea07d9b24852e3631a18e7273
SHA512 4824d91fcf8784eeb004589086b557840ba2cd4ab1e8e6a287cf0ad187891adbd57227e16097231b59fb1820991e276114403524123d8cad1b8c629b44caf5d5
SSDEEP 96:JoUX1V01ziqWJ2HsfVGvcGtT/KKmUlhYu99tZHVbjEXGJ993OKy:N6iyM4vcGF/Xlhxf1bj/93Ty
TLSH
T14BC166012F19C579257B210585B1885BFE37663317FD7818F9CF01A54FB252983B9EA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0tgmgxz0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\0tgmgxz0\0tgmgxz0.cmdline
Size 312B
SHA256 d28968aaae8ec94ddeedf345b2fef8878c2de40b2c320ee7b5af170427296fe5
MD5 6898f1f2fd20f9803de577fb27fc451b
SHA1 5f2a7ae75c4127deb6a405ff0e832461cece8266
SHA512 d898651685b0b335352bb12ac8c6f50a53295c94a28d9d54de911e897e233143b6861ea97fdfab6813a6e86d7ac0a7e1dad45c5254f4bd7b780f989722f70394
TLSH
T162E08C2B6396CB6CC3A8104B50F2C9EC47B20B772A15EB589AA0424C827B185B7A1F53
MD5 SHA1 SHA512 TLSH

Submit Download

CSCC8CDEF0F5B7246B3A56F95EB15DC72CD.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\0tgmgxz0\CSCC8CDEF0F5B7246B3A56F95EB15DC72CD.TMP
Size 1KB
SHA256 2745d9f2c7eb8bb3296dbc2c2b8bd753e62568a79b2c92260cba8cfed28ff65c
MD5 92163d648c126ac3275c3a05b01cb729
SHA1 7be3f13a052ffd709f81b04790e07d89d6a39443
SHA512 643b880249036ba2067a6c4b2cc9e9ee012006def4c119261eaa39ad3f6598eb8916ea56d57170d3345c3876fab903aa40550d32c06cc0fe72d7bcec059d9abe
TLSH
T1C321AB46A3EC820EF1B347707DF2C36391A8BE668D7943EC3488135F2F1594085836B1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2856-24-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2856-37-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2856-30-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2856-28-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2856-27-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5416-16-0x00000000050D0000-0x00000000050D8000-memory.dmp

Download

memory/5416-22-0x0000000005440000-0x000000000546C000-memory.dmp

Download

memory/5416-23-0x00000000058D0000-0x000000000596C000-memory.dmp

Download

memory/5416-19-0x0000000005130000-0x000000000513C000-memory.dmp

Download

memory/5416-18-0x0000000005410000-0x0000000005442000-memory.dmp

Download

memory/5416-17-0x0000000005230000-0x00000000052C2000-memory.dmp

Download

memory/5416-0-0x00000000007B0000-0x00000000007E2000-memory.dmp

Download

memory/5416-1-0x0000000005180000-0x0000000005190000-memory.dmp

Download