netwire | 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 01:15

Target

5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
Size

780KB
MD5

f4e294e4ff1d37874053074e502349ec
SHA1

ada0f22588448ffc218556ce12b045316d1ee418
SHA256

5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e
SHA512

c81582ce3119cc670f6092c82a525dc0fb9a4b68427646a7bc04fe0e0814845a82782c4284c5576453bc944f660778dc836d784d7f5fd780c56a101574cb0328
SSDEEP

3072:lD7fFC3Xi1NCvsHrryNyXtYUKucJcmGUcBCEHl5HHghiUjIyDvUmTncs4U+21s8D:lv06NIIKOm+YSHllAhxc2smYsvds8WC

Score

10^/10

Family

netwire

190.123.44.137:3369

Attributes

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3308-6-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral2/memory/3308-11-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral2/memory/3308-8-0x0000000000400000-0x0000000000420000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3308-6-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3308-11-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3308-8-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Suspicious use of SetThreadContext 1 IoCs

Processes:

5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe

description	pid	process	target process
PID 1316 set thread context of 3308	1316	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe

pid process

1316 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe

description pid process

Token: SeDebugPrivilege 1316 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe

pid	process
1316	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe

description	pid	process
Token: SeDebugPrivilege	1316	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe

description	pid	process	target process
PID 1316 wrote to memory of 3308	1316	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
PID 1316 wrote to memory of 3308	1316	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
PID 1316 wrote to memory of 3308	1316	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
PID 1316 wrote to memory of 3308	1316	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
PID 1316 wrote to memory of 3308	1316	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
PID 1316 wrote to memory of 3308	1316	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
PID 1316 wrote to memory of 3308	1316	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
PID 1316 wrote to memory of 3308	1316	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe

C:\Users\Admin\AppData\Local\Temp\5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
"C:\Users\Admin\AppData\Local\Temp\5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe"
2⤵
PID:3308

memory/1316-0-0x00000000753D2000-0x00000000753D3000-memory.dmp

Filesize
4KB

Download
memory/1316-1-0x00000000753D0000-0x0000000075981000-memory.dmp

Filesize
5.7MB

Download
memory/1316-2-0x00000000753D0000-0x0000000075981000-memory.dmp

Filesize
5.7MB

Download
memory/1316-3-0x00000000753D0000-0x0000000075981000-memory.dmp

Filesize
5.7MB

Download
memory/1316-4-0x00000000753D0000-0x0000000075981000-memory.dmp

Filesize
5.7MB

Download
memory/1316-12-0x00000000753D0000-0x0000000075981000-memory.dmp

Filesize
5.7MB

Download
memory/3308-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3308-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3308-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download