netwire | 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
Size

780KB
MD5

f4e294e4ff1d37874053074e502349ec
SHA1

ada0f22588448ffc218556ce12b045316d1ee418
SHA256

5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e
SHA512

c81582ce3119cc670f6092c82a525dc0fb9a4b68427646a7bc04fe0e0814845a82782c4284c5576453bc944f660778dc836d784d7f5fd780c56a101574cb0328
SSDEEP

3072:lD7fFC3Xi1NCvsHrryNyXtYUKucJcmGUcBCEHl5HHghiUjIyDvUmTncs4U+21s8D:lv06NIIKOm+YSHllAhxc2smYsvds8WC

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

190.123.44.137:3369

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3028-9-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral1/memory/3028-7-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral1/memory/3028-14-0x0000000000400000-0x0000000000420000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

Processes:

5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe

description	pid	process	target process
PID 1772 set thread context of 3028	1772	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe

pid process

1772 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe

description pid process

Token: SeDebugPrivilege 1772 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe

pid	process
1772	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe

description	pid	process
Token: SeDebugPrivilege	1772	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe

description	pid	process	target process
PID 1772 wrote to memory of 3028	1772	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
PID 1772 wrote to memory of 3028	1772	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
PID 1772 wrote to memory of 3028	1772	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
PID 1772 wrote to memory of 3028	1772	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
PID 1772 wrote to memory of 3028	1772	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
PID 1772 wrote to memory of 3028	1772	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
PID 1772 wrote to memory of 3028	1772	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
PID 1772 wrote to memory of 3028	1772	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
PID 1772 wrote to memory of 3028	1772	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe	5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe

C:\Users\Admin\AppData\Local\Temp\5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
"C:\Users\Admin\AppData\Local\Temp\5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772

C:\Users\Admin\AppData\Local\Temp\5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
"C:\Users\Admin\AppData\Local\Temp\5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe"
2⤵
PID:3028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1772-0-0x00000000749E1000-0x00000000749E2000-memory.dmp

Filesize
4KB

Download
memory/1772-1-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/1772-2-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/1772-3-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/1772-4-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/1772-5-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/1772-12-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/1772-13-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/3028-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3028-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3028-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download