netwire | 7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 19:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpkw6fryc7.exe
Size 638KB
Sample260601-x77y5sd13y
SHA256 7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d
MD5 727d339d4485e05c1cc8764c854eddbf
SHA1 c230be06684e4f27dfaa066c0d3f631232770bb6
SHA512 f1bd31e1963bc36468f0fde5c50de555e6dba5361585017e9720e249cc8133fdd72a7274928cb7ba8564d0d42d508a008ae0ee220ea9773af98f7f7b4d9c3925
SSDEEP 6144:IbjjGk3F9ELCvfCdgv232mrXLK1UTVMkayZEkcR9eKS+rId:kGkVSLCvu3nXLKoVM0EkcR9BId
TLSH
T1FAD48E75B3645EA3E5BD48B1C8228AC462306D2783D4D71E301A7B3E58723D6D21BA7F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet defense_evasion discovery netwire persistence rat stealer

Malware Config

Extracted

Family

netwire

nightwolf.dyndns-ip.com:2020

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-YCA6y0
keylogger_dir
C:\Users\Admin\AppData\Roaming\Logs\
lock_executable
false
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
false

Signatures

Family: Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\file.exe"	tmpkw6fryc7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\file.exe"	file.exe

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/3912-35-0x0000000000400000-0x0000000000417000-memory.dmp	netwire
behavioral2/memory/2128-36-0x0000000000400000-0x0000000000417000-memory.dmp	netwire

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	tmpkw6fryc7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	file.exe

Executes dropped EXE 4 IoCs

pid	Process
3912	tmp.exe
3976	file.exe
2128	tmp.exe
3428	notepad .exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/files/0x0007000000024569-23.dat	SmartAssembly

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2752 set thread context of 3428	2752	tmpkw6fryc7.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4308	3428	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpkw6fryc7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3388	timeout.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2752	tmpkw6fryc7.exe
2752	tmpkw6fryc7.exe
3976	file.exe
3976	file.exe
3976	file.exe
3976	file.exe
2752	tmpkw6fryc7.exe
2752	tmpkw6fryc7.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	tmpkw6fryc7.exe
Token: SeDebugPrivilege	3976	file.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 756	2752	tmpkw6fryc7.exe	88
PID 756 wrote to memory of 4504	756	cmd.exe	90
PID 4504 wrote to memory of 1960	4504	wscript.exe	91
PID 2752 wrote to memory of 3912	2752	tmpkw6fryc7.exe	92
PID 2752 wrote to memory of 3428	2752	tmpkw6fryc7.exe	94
PID 2752 wrote to memory of 3428	2752	tmpkw6fryc7.exe	94
PID 2752 wrote to memory of 3428	2752	tmpkw6fryc7.exe	94
PID 2752 wrote to memory of 3428	2752	tmpkw6fryc7.exe	94
PID 2752 wrote to memory of 3428	2752	tmpkw6fryc7.exe	94
PID 3976 wrote to memory of 2128	3976	file.exe	97
PID 3976 wrote to memory of 4912	3976	file.exe	98
PID 2752 wrote to memory of 3260	2752	tmpkw6fryc7.exe	115
PID 3260 wrote to memory of 3388	3260	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\tmpkw6fryc7.exe
"C:\Users\Admin\AppData\Local\Temp\tmpkw6fryc7.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\\mata.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\mata2.bat
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mata2.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:1960
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3912
- C:\Users\Admin\AppData\Local\Temp\notepad .exe
  "C:\Users\Admin\AppData\Local\Temp\notepad .exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 348
    3⤵
    - Program crash
    PID:4308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\stres.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 300
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3388

C:\Users\Admin\AppData\Local\Temp\file.exe
C:\Users\Admin\AppData\Local\Temp\file.exe
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Users\Admin\AppData\Local\Temp\notepad .exe
  "C:\Users\Admin\AppData\Local\Temp\notepad .exe"
  2⤵
  PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3428 -ip 3428
1⤵
PID:4048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.Identifier

Path C:\Users\Admin\AppData\Local\Temp\.Identifier
Size 64B
SHA256 ea8041bdf060c586bfa2178038b94ca8e169ae3927c066caa863b8e8c5c18397
MD5 3c74f3ff4b7fd5e537080c01dce14b40
SHA1 972697b1256b7de862c16e576a9e3099f3fce234
SHA512 06e0a73ee5cec2e6c006d5d9e899d646036cfbb606594c6ba544c7994e52918557486444cb6d0236f1c0a2baa75e90be8b94d6c4446d84c4fcaf3da70e7c0f81
TLSH
T130A00443011C10D5F4440470C0FF1D04011C71570F05DC5075CC50CD50C04453D10304
MD5 SHA1 SHA512 TLSH

Submit Download

invs.vbs

Path C:\Users\Admin\AppData\Local\Temp\invs.vbs
Size 78B
SHA256 20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
MD5 c578d9653b22800c3eb6b6a51219bbb8
SHA1 a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA512 3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d
TLSH
T106A02407FC04DC53011040530530CC0DCDC444707000C4747F41CCD510057400D41401
MD5 SHA1 SHA512 TLSH

Submit Download

mata.bat

Path C:\Users\Admin\AppData\Local\Temp\mata.bat
Size 47B
SHA256 6bcc0e04d9bc32209d90a65c320dc6363e523dd94b38b17bcdc5b980b6405f53
MD5 58c538a6ae20a3c6031217903cdf8e5d
SHA1 399fd50eadf4945b665877facfc4f53d16e18b1e
SHA512 c01828a5390fec3443e19d317137ae873de77c7737db7802650430e6a0a1edbd3aabe362903243b372536418fbd8482c2a6efd122d853744a41ade567956c359
MD5 SHA1 SHA512

Submit Download

mata2.bat

Path C:\Users\Admin\AppData\Local\Temp\mata2.bat
Size 47B
SHA256 22b182644ab28f5e9e17b5a03ba404d09b02da367146b80484584adc842a3ed1
MD5 095b2908ae8b2e0e3704c0163f26e283
SHA1 3429b6c1421d448c98c1da9625badcea2484a521
SHA512 e22e379b4f0d8e11fa7c29c3297a3e24a533fb08895d18e9bb27e8cab84da1dd52ff437aca90c5c32a9bdb578b3c1bfb3ff42d3bc2c5951ffeb5941c8286c731
MD5 SHA1 SHA512

Submit Download

notepad .exe

Path C:\Users\Admin\AppData\Local\Temp\notepad .exe
Size 52KB
SHA256 403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36
MD5 a64daca3cfbcd039df3ec29d3eddd001
SHA1 eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3
SHA512 b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479
SSDEEP 768:YP2Bbv+VazyoD2z9TU//1mz1+M9GnLEu+2UAFRJS8fX:zJv46yoD2BTNz1+M9GLfTw8fX
TLSH
T12C33C818A7E8432AF6FB4F755CF180068576B9979E26C31D298D039D0B363C4C922BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundll11-.txt

Path C:\Users\Admin\AppData\Local\Temp\rundll11-.txt
Size 638KB
SHA256 7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d
MD5 727d339d4485e05c1cc8764c854eddbf
SHA1 c230be06684e4f27dfaa066c0d3f631232770bb6
SHA512 f1bd31e1963bc36468f0fde5c50de555e6dba5361585017e9720e249cc8133fdd72a7274928cb7ba8564d0d42d508a008ae0ee220ea9773af98f7f7b4d9c3925
SSDEEP 6144:IbjjGk3F9ELCvfCdgv232mrXLK1UTVMkayZEkcR9eKS+rId:kGkVSLCvu3nXLKoVM0EkcR9BId
TLSH
T1FAD48E75B3645EA3E5BD48B1C8228AC462306D2783D4D71E301A7B3E58723D6D21BA7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stres.bat

Path C:\Users\Admin\AppData\Local\Temp\stres.bat
Size 200B
SHA256 acf2946adf8e613c5f2d776863f844b9572fc580eb4d9324f285d1bb3844e70e
MD5 fc10f5325d4bf4be8eaac50c0a463469
SHA1 54d4daf129d17abf8284835017865f99c70ffe22
SHA512 ae3ba84843312be74fda36615bd476f7b6aec5223cc0dbb183d42a57c27a8d2a6545f5273866ded6d3e3c31ef640724c74c0f47992c1c825f6f2e56ab5160490
TLSH
T193D0124A9A81471BD1B875FB05B9B2076AE2485A5D541AA54520CC0E624A98A32C9685
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp.exe
Size 68KB
SHA256 0b182398ee3a3b27e70bacce39a8dbd9faeec94ca2d82a12a644efecf9d426bd
MD5 0a5984405864c6f61bf0e4d5b7fbe8ed
SHA1 083051131e44a5d7a7dbba7cbbbc195849193042
SHA512 892028e7f2a128fa0706118bda10d68b415ed328cd28c2fb70c004cebe5d418259e5b28ac6d77aade568a8668db8065696d908d94a2f221d9e8b4d268c0b2ebd
SSDEEP 1536:hUN0UtdKyy3LaHyOH/1xL0RmceyqoYyffdEm/y+qqohqlLs9rxfkuIO:hUN/tjy3LGH/1xgDeyqund/y+qqohqlk
TLSH
T14663D629F90BD0F2DD69097166CFF4AF4766B530E8748E88EBC50C03E663D966208BD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2128-36-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2752-0-0x00000000013E0000-0x00000000013F0000-memory.dmp

Download

memory/2752-1-0x00000000753D2000-0x00000000753D4000-memory.dmp

Download

memory/2752-32-0x00000000013E0000-0x00000000013F0000-memory.dmp

Download

memory/2752-33-0x00000000753D2000-0x00000000753D4000-memory.dmp

Download

memory/3428-34-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3428-41-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3912-21-0x0000000000416000-0x0000000000417000-memory.dmp

Download

memory/3912-35-0x0000000000400000-0x0000000000417000-memory.dmp

Download