netwire | 2b4a6ef807924dd10f65081a11ad5193c9334e9c8aea22cf0cfd90a65193d626

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpqgt_0od7.exe
Size 567KB
Sample260601-ypeejsfy2j
SHA256 2b4a6ef807924dd10f65081a11ad5193c9334e9c8aea22cf0cfd90a65193d626
MD5 8736d4b3663567fa4350ce83083f0bcb
SHA1 e91f34ea5e741402eb6fb4ca9c16e703928a5af2
SHA512 a01a2183d4e9d0113dad8c65908c4d826f2f448fbbece61d1ad6bcd617a49a942bccd7ef63e374d6a93fcd87291ededb4ad8c58c6c10d81bc655acd073b46539
SSDEEP 12288:RM/VGR9lbM/VGR9leCOPUv8iMsVfmU8lRVrN:G/VGe/VG6s0iMgf8lRVrN
TLSH
T186C44A3236828D05C12905B648ADF9C577B5BB873A218F2F75DB630CBE0126B7F0A59D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet discovery netwire persistence rat stealer

Malware Config

Extracted

Family

netwire

cncbtc.zapto.org:3360
btcloldab.ddns.net:3360

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
uGcjuNnv
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
true

Signatures

Family: Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral3/memory/5188-14-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral3/memory/5188-15-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\service.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\service.exe	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2516	service.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chase Matter = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\service.exe -boot"	service.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2516 set thread context of 5188	2516	service.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpqgt_0od7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2516	service.exe
2516	service.exe
2516	service.exe
2516	service.exe
2516	service.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	672	tmpqgt_0od7.exe
Token: SeDebugPrivilege	2516	service.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 3884	672	tmpqgt_0od7.exe	81
PID 672 wrote to memory of 388	672	tmpqgt_0od7.exe	83
PID 3760 wrote to memory of 2516	3760	explorer.exe	85
PID 2516 wrote to memory of 5188	2516	service.exe	87
PID 2516 wrote to memory of 5188	2516	service.exe	87
PID 2516 wrote to memory of 5188	2516	service.exe	87
PID 2516 wrote to memory of 5188	2516	service.exe	87
PID 2516 wrote to memory of 5188	2516	service.exe	87
PID 2516 wrote to memory of 5188	2516	service.exe	87
PID 2516 wrote to memory of 5188	2516	service.exe	87

C:\Users\Admin\AppData\Local\Temp\tmpqgt_0od7.exe
"C:\Users\Admin\AppData\Local\Temp\tmpqgt_0od7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\tmpqgt_0od7.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\service.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:3884
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" /c, "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\service.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:388

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\service.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\service.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:5188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

service.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\service.exe
Size 567KB
SHA256 2b4a6ef807924dd10f65081a11ad5193c9334e9c8aea22cf0cfd90a65193d626
MD5 8736d4b3663567fa4350ce83083f0bcb
SHA1 e91f34ea5e741402eb6fb4ca9c16e703928a5af2
SHA512 a01a2183d4e9d0113dad8c65908c4d826f2f448fbbece61d1ad6bcd617a49a942bccd7ef63e374d6a93fcd87291ededb4ad8c58c6c10d81bc655acd073b46539
SSDEEP 12288:RM/VGR9lbM/VGR9leCOPUv8iMsVfmU8lRVrN:G/VGe/VG6s0iMgf8lRVrN
TLSH
T186C44A3236828D05C12905B648ADF9C577B5BB873A218F2F75DB630CBE0126B7F0A59D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/672-0-0x0000000000A80000-0x0000000000B12000-memory.dmp

Download

memory/672-1-0x0000000005560000-0x000000000557A000-memory.dmp

Download

memory/672-2-0x0000000005530000-0x0000000005552000-memory.dmp

Download

memory/672-3-0x00000000056C0000-0x00000000056D0000-memory.dmp

Download

memory/672-4-0x00000000065C0000-0x0000000006B66000-memory.dmp

Download

memory/672-5-0x0000000006110000-0x00000000061A2000-memory.dmp

Download

memory/672-8-0x00000000056C0000-0x00000000056D0000-memory.dmp

Download

memory/2516-12-0x0000000005930000-0x0000000005952000-memory.dmp

Download

memory/2516-13-0x00000000074F0000-0x000000000758C000-memory.dmp

Download

memory/5188-14-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5188-15-0x0000000000400000-0x000000000042C000-memory.dmp

Download