netwire | b14ea2f152e1a5710ae3c34f8d98bf85e8d07bfe48a2e03b4987272b0d783855

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp90u4qsqo.exe
Size 268KB
Sample260601-yl6dvset8w
SHA256 b14ea2f152e1a5710ae3c34f8d98bf85e8d07bfe48a2e03b4987272b0d783855
MD5 b0756a14058ba24ffa31d03c5a15c2ee
SHA1 fa92daf4a6963160e131e543c8c2a51dd8efd84e
SHA512 5591f61543b8751e3d5ffab83b6fcf7c61dc601a0c80332d05b30460aecbc7a22693d34f30e51ac8e6b67bd74cb7f0ac9459304a4bccd4e572be833374b1e415
SSDEEP 6144:XyBLkXVtU8FTskYpYr+ufYQxiaBXozlQuUCrST:XyBLkXHUwwfpJmYQcaBgvUNT
TLSH
T1C944D66479EF002DF177BFB12FE869EEDD9BFA73291A64561041030B0A51E80DE9293D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet discovery netwire rat stealer

Malware Config

Extracted

Family

netwire

fingers1.ddns.net:3360

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
false

Signatures

Family: Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

NetWire RAT payload 5 IoCs

rat

resource	yara_rule
behavioral3/memory/4704-21-0x0000000004EF0000-0x0000000004F1C000-memory.dmp	netwire
behavioral3/memory/1508-23-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral3/memory/1508-26-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral3/memory/1508-27-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral3/memory/1508-28-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url	tmp90u4qsqo.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4704 set thread context of 1508	4704	tmp90u4qsqo.exe	86

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp90u4qsqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4704	tmp90u4qsqo.exe
4704	tmp90u4qsqo.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4704	tmp90u4qsqo.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 3340	4704	tmp90u4qsqo.exe	83
PID 3340 wrote to memory of 3312	3340	csc.exe	85
PID 4704 wrote to memory of 1508	4704	tmp90u4qsqo.exe	86
PID 4704 wrote to memory of 1508	4704	tmp90u4qsqo.exe	86
PID 4704 wrote to memory of 1508	4704	tmp90u4qsqo.exe	86
PID 4704 wrote to memory of 1508	4704	tmp90u4qsqo.exe	86
PID 4704 wrote to memory of 1508	4704	tmp90u4qsqo.exe	86
PID 4704 wrote to memory of 1508	4704	tmp90u4qsqo.exe	86
PID 4704 wrote to memory of 1508	4704	tmp90u4qsqo.exe	86

C:\Users\Admin\AppData\Local\Temp\tmp90u4qsqo.exe
"C:\Users\Admin\AppData\Local\Temp\tmp90u4qsqo.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ysckreo4\ysckreo4.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5BC7.tmp" "c:\Users\Admin\AppData\Local\Temp\ysckreo4\CSC95B5D9C9E1FF4DAB9C4623B9BBD93C6.TMP"
    3⤵
    PID:3312
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5BC7.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5BC7.tmp
Size 1KB
SHA256 98f0519356854b4f202642d6bb7510c2ce90be52301ef77919f06c4d2708a4d6
MD5 6077e67fcef309059fea54b819941ef3
SHA1 5c7563eab53ac3d2a803b547a45221dd3a17495a
SHA512 9493c26f515c3c729331bcca466edd15e7a7419e5782467632930fdd93adb74da604317e1cee77fbdc18c88412c844c52bb8ec7f6c1b29117cbe1beebbad79b0
TLSH
T1F4411F0083E84B1AE17247317DF6472AA778BE56AFA9435EB484113E2F12784DD936B2
MD5 SHA1 SHA512 TLSH

Submit Download

ysckreo4.dll

Path C:\Users\Admin\AppData\Local\Temp\ysckreo4\ysckreo4.dll
Size 18KB
SHA256 64c41fcc9761cc20adc662b4fbd12ded0e4ad4cb81c4b3de43e77de1aa2d8284
MD5 79e20ea0b7248c43b2436a15205e3a13
SHA1 8baffa2bda43878d34ee9abaf6a8364f8c21feb8
SHA512 3594717627c2197ee468c8e79670f94d72b7e35b781fee812adbb81b4bd63a22529083682cb538d523fedcd02ab09fd6607e93dd2314b43a99250c20ba8e85cc
SSDEEP 384:0DRxGfTdkStVoC32r/7mz1xZV9OUKizrOIO2cuMXjo:0DReTxtVoC3K6R7V9b/ziDFRXjo
TLSH
T107821989BBE34345EE2D6E74FD51A764973438C38AA793C511C962FC3B2AB414853DE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysckreo4.pdb

Path C:\Users\Admin\AppData\Local\Temp\ysckreo4\ysckreo4.pdb
Size 59KB
SHA256 ac75583991790a39ec223ebdfe45995beff86b35cb1bac71e28a68b4ebc2bc70
MD5 e894d0a32509ee46fd56df1597bd9bf7
SHA1 232e9b967a19a696a51279fed75fde0b36ad56e2
SHA512 2bc6438ce22d4c0a37989058caace5ae25833e80405a99d50acfb0bfa829a49561d7e9b3ba97f86f393408b905ddd8f987460698f9cf8a5b9262e11951627cfe
SSDEEP 768:nBa9uAxOXB5DToqsVqyAUXIEdj3E71Yb8kI75tsVw:nI3C3Toq0qyHfh3ERK80i
TLSH
T1CB531C46BFC1CA32D427C73C969B4F1D4238EC885B97A74B87A5B53CBDB23591C82294
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC95B5D9C9E1FF4DAB9C4623B9BBD93C6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ysckreo4\CSC95B5D9C9E1FF4DAB9C4623B9BBD93C6.TMP
Size 1KB
SHA256 eb0864d080052ed264ae589a67d71985c8ddd1697b4c2d98e10db802049d21ae
MD5 63912da4d0f67a5ca8d2dc42312f9f8a
SHA1 36b6b6859820e2640f27c2b6b2083ec00c8214ed
SHA512 591db74cb5e89daa3ef59a58b22833982fcfbd2ea9202192628a3592f8aac2a079e347aaf774a5e83675371f4b8290ce011baef4a8172609fca34dd309dfb709
TLSH
T1BD21AB46A3E8420EF2B347707DF68363A5ACBE668D7943EC3888135F2F2594585936B1
MD5 SHA1 SHA512 TLSH

Submit Download

ysckreo4.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ysckreo4\ysckreo4.0.cs
Size 41KB
SHA256 ad4289e7c602558bac01b65ae5156f7459caa2819e902dde82e48e323035f0d8
MD5 ec5624b94e764943d7754cc907580206
SHA1 0e4374acc86688486c4539c1972db7de5747f6a7
SHA512 4ff2da150a128a9998675bce68bf0231cfb392b56bb47f62398a44b7e4978b186fbd99e64aa5cbbc73db5046dacafe0a8472ec6a6dd6763d3624f77f867cb540
SSDEEP 768:SuKilqZv/mlyXYGMUjpgVihrb9JTgez+A5Px3kGh99kGpcv:Sti8Zv/syXY7UjpTrbvTgez+Ar3kGh9e
TLSH
T14E13D7102B59CDB4696D21809492C897FE33AE134F7EB458F18F41E94BD3CAD52B98F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysckreo4.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ysckreo4\ysckreo4.cmdline
Size 312B
SHA256 1602cd34195195628ed30e0668594d1ab1d423ca546f3ff72f126c8b44746a57
MD5 d0dccd4b41d7aa0da090bd97f62dc9a0
SHA1 2f11f78248d71f067f4ed811690396b4a61481e5
SHA512 8d732e02b79d83ca7f742ff20d703ffb276083ad593770acb68840dffa1ac07af56a8607100050319fc7d7217638f6548c55a4a45125cbd46385f4954a7dc5d6
TLSH
T1D1E0CD3A8B97C7AC05EC1447A0E1C5ED4BB20A273809BF5897A0404C627B04557E9F53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1508-23-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1508-28-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1508-27-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1508-26-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4704-16-0x0000000002840000-0x000000000284A000-memory.dmp

Download

memory/4704-19-0x0000000004D70000-0x0000000004D7C000-memory.dmp

Download

memory/4704-21-0x0000000004EF0000-0x0000000004F1C000-memory.dmp

Download

memory/4704-22-0x00000000054C0000-0x000000000555C000-memory.dmp

Download

memory/4704-18-0x0000000004EB0000-0x0000000004EE2000-memory.dmp

Download

memory/4704-17-0x0000000004D80000-0x0000000004E12000-memory.dmp

Download

memory/4704-0-0x0000000000290000-0x00000000002DA000-memory.dmp

Download

memory/4704-1-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Download