netwire | 2084-138-0x0000000000700000-0x0000000001700000-memory[.]dmp | Triage

Sharing

General

Target

2084-138-0x0000000000700000-0x0000000001700000-memory.dmp
Size

16.0MB
MD5

c47be8ee721cf35cb79235b21ff77efc
SHA1

009af13f378902d387ca5ab2a554154c4f344ab4
SHA256

24672d866fafe53b9e4c7c1596e716c8050d469829458c7084220efdcc5124b4
SHA512

c0e0ff261f235a67747882707a9d7365dc8e2e39398ef8cc1426b8d8e14491fcbe76d374465140eef31aff920db6080d029bf1cdcd83e89d8475fd8be3b90e79
SSDEEP

6144:nOrRY9YOsbuwtrkPnHLOjaezR8l1uPdS6I7BoXqqD8HR8B:nOFY9YO0gLOjaezR8l1ggqXB

Score

10^/10

rat netwire

Malware Config

Extracted

Family

netwire

C2

banqueislamik.ddrive.online:3360

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
SALUT
lock_executable
false
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 1 IoCs
rat

Processes:

resource yara_rule

sample netwire
Netwire family
netwire

Files

2084-138-0x0000000000700000-0x0000000001700000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ