netwire | 9388d5c99546d163b0faa6c1212142996a455696fc44a393f4593a58e04b21e9

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 13:30

Target

a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
Size

689KB
MD5

a0d51a380de1987d828f8454b11c284b
SHA1

b68a9a468cef7665d5e5b35e2e5ce3b809d2dc8e
SHA256

9388d5c99546d163b0faa6c1212142996a455696fc44a393f4593a58e04b21e9
SHA512

5bb8d6f50efdaa7e340bb1a821989e68f45a55167a43b840201e8b4fcc8d98cd6baf932740c8b32fc1e173777d9ce49ed8e2f28671ed9e9d34e9c56d9b07569d
SSDEEP

12288:0BC1tAx0SFUAvfoW6YovGFJyP+wlk+Spy+8l/6jR6fHecv9nslZbQZXsborvFY0E:1159J4vYzUdMrM

Score

10^/10

Family

netwire

blessedwithwealth.servehumour.com:39560

Attributes

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2744-3-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/2744-7-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/2744-9-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/2744-10-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe

description	pid	process	target process
PID 2108 wrote to memory of 2744	2108	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 2108 wrote to memory of 2744	2108	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 2108 wrote to memory of 2744	2108	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 2108 wrote to memory of 2744	2108	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 2108 wrote to memory of 2744	2108	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 2108 wrote to memory of 2744	2108	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 2108 wrote to memory of 2744	2108	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 2108 wrote to memory of 2744	2108	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 2108 wrote to memory of 2744	2108	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 2108 wrote to memory of 2744	2108	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 2108 wrote to memory of 2744	2108	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 2108 wrote to memory of 2744	2108	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 2108 wrote to memory of 2744	2108	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 2108 wrote to memory of 2744	2108	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe

memory/2108-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2108-1-0x0000000001EF0000-0x0000000001F6B000-memory.dmp

Filesize
492KB

Download
memory/2108-2-0x000000007797F000-0x0000000077980000-memory.dmp

Filesize
4KB

Download
memory/2108-4-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2108-6-0x0000000001EF0000-0x0000000001F6B000-memory.dmp

Filesize
492KB

Download
memory/2744-5-0x000000007797F000-0x0000000077980000-memory.dmp

Filesize
4KB

Download
memory/2744-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2744-7-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2744-8-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2744-9-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2744-10-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download