netwire | 90dbd6dce0e0e7013656333f1cd8a9b7660e0e40e782a622856800c52e980d3e

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpyoffywid.exe
Size 316KB
Sample260601-xt4dsse15m
SHA256 90dbd6dce0e0e7013656333f1cd8a9b7660e0e40e782a622856800c52e980d3e
MD5 205460f0adbfe5667223d1e5b3d9a9ee
SHA1 78e909ffd58734dc411d22fc72d27a833db4b969
SHA512 104ba781eb949821bad8789271feab185a2aa28ff1c6fc35cfd0bf44eee1ff7ed2412dd17d60831d55bee6af7d0731d80091f5e2edeebbc6fb3a1f622bbff775
SSDEEP 6144:Yr1I5DbAQcHAORYANchcXmpa9kf3YKOvmTPkjmnxFrM:M1I5fAPHIumCkw+smbY
TLSH
T1D064E1AE73E2C472C0B6027442949BB3D579BE32027480B7FBE85D5E1E70AD1156539F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet discovery execution netwire persistence rat stealer

Malware Config

Extracted

Family

netwire

ceo2021.duckdns.org:5594

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
New-Client
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
rNLbjFgr
offline_keylogger
true
password
okey@080
registry_autorun
false
use_mutex
true

Signatures

Family: Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

NetWire RAT payload 4 IoCs

rat

resource	yara_rule
behavioral3/memory/4864-4-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral3/memory/4864-6-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral3/memory/4864-7-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral3/memory/4864-13-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Executes dropped EXE 6 IoCs

pid	Process
3772	whitemanth.exe
3652	whitemanth.exe
5420	whitemanth.exe
3492	whitemanth.exe
4480	whitemanth.exe
3300	whitemanth.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 6116 set thread context of 4864	6116	tmpyoffywid.exe	82
PID 4480 set thread context of 3300	4480	whitemanth.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpyoffywid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpyoffywid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whitemanth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whitemanth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whitemanth.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5992	schtasks.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
6116	tmpyoffywid.exe
3772	whitemanth.exe
5420	whitemanth.exe
4480	whitemanth.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 6116 wrote to memory of 4816	6116	tmpyoffywid.exe	81
PID 6116 wrote to memory of 4864	6116	tmpyoffywid.exe	82
PID 4816 wrote to memory of 5992	4816	cmd.exe	84
PID 3772 wrote to memory of 3652	3772	whitemanth.exe	87
PID 3772 wrote to memory of 5420	3772	whitemanth.exe	88
PID 5420 wrote to memory of 3492	5420	whitemanth.exe	89
PID 5420 wrote to memory of 4480	5420	whitemanth.exe	90
PID 4480 wrote to memory of 3300	4480	whitemanth.exe	91

C:\Users\Admin\AppData\Local\Temp\tmpyoffywid.exe
"C:\Users\Admin\AppData\Local\Temp\tmpyoffywid.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:6116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /Create /TN loserty /XML "C:\Users\Admin\AppData\Local\Temp\5114842f0dd2444f9d7295083ca8bde7.xml"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /TN loserty /XML "C:\Users\Admin\AppData\Local\Temp\5114842f0dd2444f9d7295083ca8bde7.xml"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5992
- C:\Users\Admin\AppData\Local\Temp\tmpyoffywid.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpyoffywid.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4864

C:\Users\Admin\AppData\Local\Temp\sacacrtyfree\whitemanth.exe
C:\Users\Admin\AppData\Local\Temp\sacacrtyfree\whitemanth.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Users\Admin\AppData\Local\Temp\sacacrtyfree\whitemanth.exe
  C:\Users\Admin\AppData\Local\Temp\sacacrtyfree\whitemanth.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Users\Admin\AppData\Local\Temp\sacacrtyfree\whitemanth.exe
  "C:\Users\Admin\AppData\Local\Temp\sacacrtyfree\whitemanth.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:5420
- - C:\Users\Admin\AppData\Local\Temp\sacacrtyfree\whitemanth.exe
    "C:\Users\Admin\AppData\Local\Temp\sacacrtyfree\whitemanth.exe"
    3⤵
    - Executes dropped EXE
    PID:3492
- - C:\Users\Admin\AppData\Local\Temp\sacacrtyfree\whitemanth.exe
    "C:\Users\Admin\AppData\Local\Temp\sacacrtyfree\whitemanth.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\sacacrtyfree\whitemanth.exe
      "C:\Users\Admin\AppData\Local\Temp\sacacrtyfree\whitemanth.exe"
      4⤵
      Executes dropped EXE
      PID:3300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5114842f0dd2444f9d7295083ca8bde7.xml

Path C:\Users\Admin\AppData\Local\Temp\5114842f0dd2444f9d7295083ca8bde7.xml
Size 1KB
SHA256 e91e13dffa5f75901a312418c272a7638ed180580dcc6961b05b7244aa64379d
MD5 b8c7172a42d6718dd88d4557fa3213ed
SHA1 80c14c4bcfbe6bb455da4e0f6a4ee3eb721370aa
SHA512 504699e767bcfdf4ca6b74b54056e60d2941a3a2e48ca38bfb6de8a844a560a1bc0d43f3d164af2561cec6fbdb3605d048be621c795074a30ee78a3da75de54a
TLSH
T1B02175A05C10FF1B6D54503D834252C2923B1F7649F00035DF8CC9BA748D9873162B7B
MD5 SHA1 SHA512 TLSH

Submit Download

whitemanth.exe

Path C:\Users\Admin\AppData\Local\Temp\sacacrtyfree\whitemanth.exe
Size 316KB
SHA256 9cc0914c74511f8b367bc40141fff6e3f7969057722d3d6e81269adad20fa46b
MD5 a6c8af0f098a5de6fe347be3a58ce1bf
SHA1 ac9071990a4ddd4ca46576f367f9dd9655531186
SHA512 bf56846ab21d8e377e3d1018c5467901da14b98197922f073a762f8a2cceed446512ec0adf2bfb2e58f5602844554e763f49722216a992080e920f1132750b9f
SSDEEP 6144:Yr1I5DbAQcHAORYANchcXmpa9kf3YKOvmTPkjmnxFr:M1I5fAPHIumCkw+smb
TLSH
T1C064E1AE73E2C472C0B6027442949BB3D579BE32027480B7FBE85D5E1E70AD1156539F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3772-12-0x0000000000E00000-0x0000000000F00000-memory.dmp

Download

memory/3772-14-0x0000000000E00000-0x0000000000F00000-memory.dmp

Download

memory/4864-4-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4864-6-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4864-7-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4864-13-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/6116-2-0x0000000000860000-0x0000000000960000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads