Extracted

• • Target
    Order Inquiry .xlsm
  • Size 416KB
  • SHA256 88ae975f4e74736af2a5a9afdb5fa9cdac99f6040495fa9b41b15116ca038edc
  • MD5 b5ccbececf177765cf326f65d0ca232e
  • SHA1 179fff5189d833d805f4cfa8edd24fb7320a621b
  • SHA512 47dfd402b3b5a2fcca274f65685a2bb9c4171dec3077b72a54702cdfe06d61a4117c2a42ad8753740fa734cf88da02a801226f2141bd1e994c3e6759754ccc58
  • MD5 SHA1 SHA512

  Score

  10^/10

  netwirebotnetratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2