netwire | e49a3e956dc1299041ed6f3c8a80a444f1e7f82a09bdb5044306a5e924818f43

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 19:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpsw0a9gwv.exe
Size 181KB
Sample260524-yjn2sshx81
SHA256 e49a3e956dc1299041ed6f3c8a80a444f1e7f82a09bdb5044306a5e924818f43
MD5 0c836cda6823cc0b4b77008312e9720c
SHA1 cca0f066989f5c990a40772221156abec9f6858c
SHA512 cc54afec9c829b7e9f282323707712faecfafee6639c50ebfc40da4407d3ebb070918618115828916cc6f67b9928340c177ee41b4bec5a9a529c7de9cbca61cb
SSDEEP 3072:mTXJxJqD0RVbkoh6tafBJd6crswsF05u46xpMigkdIZ2T8UCEU:Kw0RVIAAa5n6aswsF0MxlgqDTtCf
TLSH
T13204CE14F1ED911EF663BBB12BCB54DD9C9AFA72E60269E63382130E4950FC0DD1163A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet discovery netwire rat stealer

Malware Config

Extracted

Family

netwire

snoopdmoney2018.sytes.net:3864
snoopdmoneybkup.sytes.net:3864

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
hfqIXkNC
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
true

Signatures

Family: Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

NetWire RAT payload 6 IoCs

rat

resource	yara_rule
behavioral3/memory/2072-22-0x0000000004DE0000-0x0000000004E0C000-memory.dmp	netwire
behavioral3/memory/692-24-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral3/memory/692-27-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral3/memory/692-28-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral3/memory/692-29-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral3/memory/692-36-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fBKDCV.url	tmpsw0a9gwv.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2072 set thread context of 692	2072	tmpsw0a9gwv.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpsw0a9gwv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2072	tmpsw0a9gwv.exe
2072	tmpsw0a9gwv.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2072	tmpsw0a9gwv.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 3924	2072	tmpsw0a9gwv.exe	80
PID 3924 wrote to memory of 2200	3924	csc.exe	82
PID 2072 wrote to memory of 692	2072	tmpsw0a9gwv.exe	83
PID 2072 wrote to memory of 692	2072	tmpsw0a9gwv.exe	83
PID 2072 wrote to memory of 692	2072	tmpsw0a9gwv.exe	83
PID 2072 wrote to memory of 692	2072	tmpsw0a9gwv.exe	83
PID 2072 wrote to memory of 692	2072	tmpsw0a9gwv.exe	83
PID 2072 wrote to memory of 692	2072	tmpsw0a9gwv.exe	83
PID 2072 wrote to memory of 692	2072	tmpsw0a9gwv.exe	83

C:\Users\Admin\AppData\Local\Temp\tmpsw0a9gwv.exe
"C:\Users\Admin\AppData\Local\Temp\tmpsw0a9gwv.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vf1jqs5k\vf1jqs5k.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9F29.tmp" "c:\Users\Admin\AppData\Local\Temp\vf1jqs5k\CSC67A0ADD740A74F89975C8DCF162C271.TMP"
    3⤵
    PID:2200
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  PID:692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES9F29.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9F29.tmp
Size 1KB
SHA256 668ee93eef888e5ec18744ce022fa94e5b8d8489b44ec8cdad643b143172b58e
MD5 ccd9f5875cf2ef43f49a4ee4c0fa4c93
SHA1 c2f3479d3ebcfa1f923cf835768adab17918cb59
SHA512 77af24ed3ede9ea7594c8bcc0fab2f03f97b85146914045f6b950dff4b38ad7aae9a65ea2ba1e92cac91a0cdf2e7b23a137259683f3d83cac21c1a121da04f53
TLSH
T1DB41334083E88B1BF07307312DF7972AA678BE659FA9475EB584023E1F01744DD932B2
MD5 SHA1 SHA512 TLSH

Submit Download

vf1jqs5k.dll

Path C:\Users\Admin\AppData\Local\Temp\vf1jqs5k\vf1jqs5k.dll
Size 7KB
SHA256 0827b1f2aa7ae31b2abb7b0a1d4c34515bd33b559114607d0e908958634f2e9a
MD5 61d04165542a86fc43d69f9f66ff069c
SHA1 d63a9f1965ff479c429e295b412a763938f3c0db
SHA512 5b5b79659cc9676e7aa6602d6e06842d04275d0d39068830440e6948fb8d0950a376258244c97fd46b4ea72990951930870bc2d8f577a8ae0fdda6cd7ebc58f3
SSDEEP 96:BeUcuEMZkTeIfs263/u0PidWwjXGWv7+kldjCoSsaEVLgUKfKDzNt:BeUcuZ3upUwDFG3EVUcF
TLSH
T135F1F74793994A1DE96E07346C7383106FB1D6594EA3A79E5DC800783FA23905813BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vf1jqs5k.pdb

Path C:\Users\Admin\AppData\Local\Temp\vf1jqs5k\vf1jqs5k.pdb
Size 23KB
SHA256 9548af908add679caae9cf617c888e58f5dc59350328dafd5a0352eba2401d5b
MD5 d3c4c37fb57de62add7b0ddadb20e4cc
SHA1 7132548a6a99707a5af916f32d989394b120ada9
SHA512 15ba42656d3ea462c7a1e727c9a6766e96172865c9143e44d7ccdb6a9c58ba2c73239c96977bb18c55b0195fb9e83118d221b36ab8b9d05aa5c1153c7b3480b8
SSDEEP 192:1AFACX2BJ8nmpoyTZ7jVpjc6jT1lSFjdulvbXusbKWIYnnTtlXWqH:FCWJsijHfF9
TLSH
T1BBB2BC537B81DA32C8568A3C6AAB8F1D4374FC885F87A75B5752B22D3DF23991E80250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC67A0ADD740A74F89975C8DCF162C271.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\vf1jqs5k\CSC67A0ADD740A74F89975C8DCF162C271.TMP
Size 1KB
SHA256 413626a9763d58979d8f3a4e77fa670bf07fc049ea5a9022312833cf869de5c0
MD5 8c5d1b0ff59c345158c9ecbd40967003
SHA1 3ee9e50d4827fa4af822c36bb58b00cc14c6e18d
SHA512 22811b251e9b04e1901ca08e6f0afb43df0c5b7e25714a57f034fc2da20bfa930dc13790c8abd54154de0075fcee7e6e006a28759d9f3b116210849ccef2a969
TLSH
T17121AB85A3E8820EF1B34B707DF2936391A8BE668D7E43EC7488135F2F15540C5936B1
MD5 SHA1 SHA512 TLSH

Submit Download

vf1jqs5k.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\vf1jqs5k\vf1jqs5k.0.cs
Size 5KB
SHA256 7dbc8e65af713107b3c6dabbe54fa6f8d96a2523f695aba89bc6a0a21f0c7930
MD5 8bd152b7219f148baf07dc977f925f4a
SHA1 aa4af14f9fc1887ea07d9b24852e3631a18e7273
SHA512 4824d91fcf8784eeb004589086b557840ba2cd4ab1e8e6a287cf0ad187891adbd57227e16097231b59fb1820991e276114403524123d8cad1b8c629b44caf5d5
SSDEEP 96:JoUX1V01ziqWJ2HsfVGvcGtT/KKmUlhYu99tZHVbjEXGJ993OKy:N6iyM4vcGF/Xlhxf1bj/93Ty
TLSH
T14BC166012F19C579257B210585B1885BFE37663317FD7818F9CF01A54FB252983B9EA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vf1jqs5k.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\vf1jqs5k\vf1jqs5k.cmdline
Size 312B
SHA256 da5e87664188fee5cea5c81e947758d782a5c037ed60d566e99bc11bf003f3b9
MD5 0d727cc468aa61b557f76e4c6b5969a4
SHA1 a53f99c2d4112f6e1468971f8f23d80db8d96f0e
SHA512 7123626ec83a99640fd440c8e316bb61a2a0edf7daeee15ab84d31121c3d8ac992cabcff15a6c220212f416fb54d9738a01ab220c0746ae552f1e896eb17300f
TLSH
T1C8E0C23A63D7CB6D16AD104B50F2C5EC83F24B27390DAE58DAA2404C62BB08667F1F57
MD5 SHA1 SHA512 TLSH

Submit Download

memory/692-24-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/692-36-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/692-29-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/692-28-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/692-27-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2072-16-0x0000000002630000-0x0000000002638000-memory.dmp

Download

memory/2072-22-0x0000000004DE0000-0x0000000004E0C000-memory.dmp

Download

memory/2072-23-0x00000000053C0000-0x000000000545C000-memory.dmp

Download

memory/2072-19-0x0000000004C20000-0x0000000004C2C000-memory.dmp

Download

memory/2072-18-0x0000000004DB0000-0x0000000004DE2000-memory.dmp

Download

memory/2072-17-0x0000000004C40000-0x0000000004CD2000-memory.dmp

Download

memory/2072-0-0x0000000000190000-0x00000000001C2000-memory.dmp

Download

memory/2072-1-0x0000000004D60000-0x0000000004D70000-memory.dmp

Download