netwire | b2069e643e0a48cb2f2e8e4eab1e3d9701c29155b13d783fe0fef061dd9d5145

Analysis

Target

Dachser Consulta de cliente saliente no. 000150849 - SKBMT03082020-0012-IMG0149.exe
Size

686KB
MD5

6998ca30e81c5ae0fda8e67ced0e2cbd
SHA1

3977c48bae879d9f28c741645f7eb1571caf3bcf
SHA256

dfc8f0a7456a2b40908d901c2468d372bd859abda04e50ef4cf45ec84668cdcb
SHA512

ca61bc204bcc8d1dbce6711ca001bef26418163507583689189790459e210363c19b2eec7e360dec1c8fcdd6dc35074a92eee4823628e88d5589b25a00fe42df

Score

10^/10

NetWire RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3116-136-0x0000000000AB0000-0x0000000000AE4000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

C:\Users\Admin\AppData\Local\Temp\Dachser Consulta de cliente saliente no. 000150849 - SKBMT03082020-0012-IMG0149.exe
"C:\Users\Admin\AppData\Local\Temp\Dachser Consulta de cliente saliente no. 000150849 - SKBMT03082020-0012-IMG0149.exe"
1⤵
PID:3116

memory/3116-130-0x00000000779E0000-0x0000000077B83000-memory.dmp

Filesize
1.6MB

Download
memory/3116-132-0x0000000076F80000-0x0000000077195000-memory.dmp

Filesize
2.1MB

Download
memory/3116-133-0x00000000779E0000-0x0000000077B83000-memory.dmp

Filesize
1.6MB

Download
memory/3116-134-0x0000000076670000-0x0000000076760000-memory.dmp

Filesize
960KB

Download
memory/3116-135-0x0000000076F80000-0x0000000077195000-memory.dmp

Filesize
2.1MB

Download
memory/3116-136-0x0000000000AB0000-0x0000000000AE4000-memory.dmp

Filesize
208KB

Download