netwire | b14ea2f152e1a5710ae3c34f8d98bf85e8d07bfe48a2e03b4987272b0d783855

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp90u4qsqo.exe
Size 268KB
Sample260601-yl6dvset8w
SHA256 b14ea2f152e1a5710ae3c34f8d98bf85e8d07bfe48a2e03b4987272b0d783855
MD5 b0756a14058ba24ffa31d03c5a15c2ee
SHA1 fa92daf4a6963160e131e543c8c2a51dd8efd84e
SHA512 5591f61543b8751e3d5ffab83b6fcf7c61dc601a0c80332d05b30460aecbc7a22693d34f30e51ac8e6b67bd74cb7f0ac9459304a4bccd4e572be833374b1e415
SSDEEP 6144:XyBLkXVtU8FTskYpYr+ufYQxiaBXozlQuUCrST:XyBLkXHUwwfpJmYQcaBgvUNT
TLSH
T1C944D66479EF002DF177BFB12FE869EEDD9BFA73291A64561041030B0A51E80DE9293D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet discovery netwire rat stealer

Malware Config

Extracted

Family

netwire

fingers1.ddns.net:3360

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
false

Signatures

Family: Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

NetWire RAT payload 5 IoCs

rat

resource	yara_rule
behavioral2/memory/3992-21-0x0000000004C90000-0x0000000004CBC000-memory.dmp	netwire
behavioral2/memory/1880-23-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/1880-26-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/1880-27-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/1880-28-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url	tmp90u4qsqo.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3992 set thread context of 1880	3992	tmp90u4qsqo.exe	92

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp90u4qsqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3992	tmp90u4qsqo.exe
3992	tmp90u4qsqo.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3992	tmp90u4qsqo.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 2628	3992	tmp90u4qsqo.exe	87
PID 2628 wrote to memory of 1092	2628	csc.exe	91
PID 3992 wrote to memory of 1880	3992	tmp90u4qsqo.exe	92
PID 3992 wrote to memory of 1880	3992	tmp90u4qsqo.exe	92
PID 3992 wrote to memory of 1880	3992	tmp90u4qsqo.exe	92
PID 3992 wrote to memory of 1880	3992	tmp90u4qsqo.exe	92
PID 3992 wrote to memory of 1880	3992	tmp90u4qsqo.exe	92
PID 3992 wrote to memory of 1880	3992	tmp90u4qsqo.exe	92
PID 3992 wrote to memory of 1880	3992	tmp90u4qsqo.exe	92

C:\Users\Admin\AppData\Local\Temp\tmp90u4qsqo.exe
"C:\Users\Admin\AppData\Local\Temp\tmp90u4qsqo.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\msz0nhqc\msz0nhqc.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES17AA.tmp" "c:\Users\Admin\AppData\Local\Temp\msz0nhqc\CSC85D66AD8CEE54447A5B139F0DAAB3AA2.TMP"
    3⤵
    PID:1092
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES17AA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES17AA.tmp
Size 1KB
SHA256 5a6dfd3e61cc22ee1cffb40f5e27812717ebdf97f4daf282539acf8044822ac3
MD5 ab384d591c24d3f797852879eb4a28c1
SHA1 bf544dd6e2e36f54a786b1d86a06056c6fca99f5
SHA512 036755ee1576d23a6f0c587506b0b5a5bdbed2fa760dabe9dd32b6d554ea66feb071d406738c0bca90b730ddab9802251eba1a8ead9da23dbc0567c3e5629b7b
TLSH
T198414F0483D88B1AE17247312DF7571AA678BE56AFAA435EB484123E2F02744DD932B1
MD5 SHA1 SHA512 TLSH

Submit Download

msz0nhqc.dll

Path C:\Users\Admin\AppData\Local\Temp\msz0nhqc\msz0nhqc.dll
Size 18KB
SHA256 2f6b4a8d206e8bc91f93554d68c9c3c8e320a54b5b5ee285f2c0f163a6f3bca4
MD5 01cc53492b8b0ced4f3943dcf47a2639
SHA1 2c49aa12132dab8b17ee564bcf0d7f904771c9ec
SHA512 430eb789812aefc1d700d475e25e9c43d772d2ff9c049e59ede5142f267d52ca351a5bbf2dbf1e518cbcdcdadcaca28d5ea160a16f15c2c2d8f656a0d138a13d
SSDEEP 384:ZDRxGfTdkStVoC32r/7mz1xZV9OUKizr+IDi2cuejBf:ZDReTxtVoC3K6R7V9b/zqEiFLjBf
TLSH
T168821989BBE34345EE2D6E74FD51A764973438C38AA793C511C9A2FC3B2AB404853DE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msz0nhqc.pdb

Path C:\Users\Admin\AppData\Local\Temp\msz0nhqc\msz0nhqc.pdb
Size 59KB
SHA256 49ab12820fce23b07f2cbd5202eba3147844d836aba682f460f73f39b83a7321
MD5 b897534f729f32c31069db4e4a4fbde9
SHA1 1c0c315a2abdc56d4e6d94f8f2f379d563b14bd2
SHA512 ee8e5f6e2fb233f1464a5adfa38a9bb1023d11b0960c92d5945a8933c02264ef500bb14f472eefbe79232d3c9c4160749664ad69d86b7f4d338ca27291dc64d6
SSDEEP 768:gBaNuA1OcBRjvoquVqmaUXIEdj3sKuVb8kI75tI2tvfh:gInBfvoqKqmRfh3spd8g2tvZ
TLSH
T107530C46BFC1CA33D427873C969B4F1D4238EC886B97A70F46A5B57CBDB23591C82294
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC85D66AD8CEE54447A5B139F0DAAB3AA2.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\msz0nhqc\CSC85D66AD8CEE54447A5B139F0DAAB3AA2.TMP
Size 1KB
SHA256 d2ce55c31ef70a4c06b189fb4ddf4764f711609add072149e90eec4ac7905170
MD5 5a3c0f3c9009abb82679c2eb8c96231a
SHA1 60608ea236b18effcb09d095cccd21fb18df9600
SHA512 d879984c321dda9080b92739e401677d6b65a538b55a68c563e9e34939c9439b9e692bf6a7f8ba0a3964a4e398422769d05c2828bf6ae2fb637cfaa2d327d842
TLSH
T154218945A3E8820AF1B34B707DF2936391ACBE668D7A43EC34C8135B2F1594089936B1
MD5 SHA1 SHA512 TLSH

Submit Download

msz0nhqc.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\msz0nhqc\msz0nhqc.0.cs
Size 41KB
SHA256 ad4289e7c602558bac01b65ae5156f7459caa2819e902dde82e48e323035f0d8
MD5 ec5624b94e764943d7754cc907580206
SHA1 0e4374acc86688486c4539c1972db7de5747f6a7
SHA512 4ff2da150a128a9998675bce68bf0231cfb392b56bb47f62398a44b7e4978b186fbd99e64aa5cbbc73db5046dacafe0a8472ec6a6dd6763d3624f77f867cb540
SSDEEP 768:SuKilqZv/mlyXYGMUjpgVihrb9JTgez+A5Px3kGh99kGpcv:Sti8Zv/syXY7UjpTrbvTgez+Ar3kGh9e
TLSH
T14E13D7102B59CDB4696D21809492C897FE33AE134F7EB458F18F41E94BD3CAD52B98F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msz0nhqc.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\msz0nhqc\msz0nhqc.cmdline
Size 312B
SHA256 b8b6226d5e548b1a4b54f15636e99f88d901ffaf81d94ff01edefe8a92d3df46
MD5 42db84050915316e8db4fd83b4e6c5aa
SHA1 046ecc0da7f8c34fe9cd3b6bb5b803ff36af6c5d
SHA512 533942567c805a9b9082077833f9c7dcaa2cb3f6243f488ca9b7b001f0a1ba2213d39473cb804fe134d4e559a9c0a305acb3771584bea9565ab2f8184485f92c
TLSH
T132E0862AC396C76C05F9104750E1C9EC52B20A3768266BAD9EB0824C42BB75557E6B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1880-23-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1880-28-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1880-27-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1880-26-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3992-16-0x0000000004940000-0x000000000494A000-memory.dmp

Download

memory/3992-19-0x0000000004C60000-0x0000000004C6C000-memory.dmp

Download

memory/3992-21-0x0000000004C90000-0x0000000004CBC000-memory.dmp

Download

memory/3992-22-0x00000000051D0000-0x000000000526C000-memory.dmp

Download

memory/3992-18-0x0000000004A50000-0x0000000004A82000-memory.dmp

Download

memory/3992-17-0x0000000004A80000-0x0000000004B12000-memory.dmp

Download

memory/3992-0-0x0000000000010000-0x000000000005A000-memory.dmp

Download

memory/3992-1-0x00000000049D0000-0x00000000049E0000-memory.dmp

Download