netwire | c2268bf31831425cafcea2863195457979514c2213bda36f8e0a17f411f99ca9 | Triage

Analysis

max time kernel
116s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
01-07-2022 04:54

Sharing

Report Analysis Logs

General

Target

c2268bf31831425cafcea2863195457979514c2213bda36f8e0a17f411f99ca9.exe
Size

606KB
MD5

8ecf0b8f8a455125d1aa583acc4e9ad3
SHA1

33706f04cead4adfd94118fed35f23b79752b434
SHA256

c2268bf31831425cafcea2863195457979514c2213bda36f8e0a17f411f99ca9
SHA512

572e5b22d97ffcbc4884743100793eb4b4507cf1a8a162818e9773b996b2326531a3193bf22311724e0ccd40dbc633407cf241748b75f954872adfd84ae6a8a1

Score

10^/10

netwire botnet rat stealer

Malware Config

Signatures

NetWire RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1348-130-0x0000000000400000-0x00000000004A2000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\c2268bf31831425cafcea2863195457979514c2213bda36f8e0a17f411f99ca9.exe
"C:\Users\Admin\AppData\Local\Temp\c2268bf31831425cafcea2863195457979514c2213bda36f8e0a17f411f99ca9.exe"
1⤵
PID:1348

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1348-130-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download