Overview

overview

10

Static

static

10

1872-66-0x...ry.exe

windows7-x64

1

1872-66-0x...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    1872-66-0x0000000000400000-0x0000000000433000-memory.dmp

  • Size

    204KB

  • MD5

    fb89ff1c7aed893de52b4cb2f940358b

  • SHA1

    4c4333b5e74d8cc3a6aa7f13886158c01855cdde

  • SHA256

    5f5c45a47ef2517c6fb7a607d31e70709b553c964b75943267a8fe628baad6f7

  • SHA512

    c247a28a57e2fe792fb02854c134a7269a96cf59ae3b201fd1d12466379f15f68112cbeeea220adf11446781ea598f0d93bcaf5cdff34cacaab2d85ce22a4407

  • SSDEEP

    3072:S3bwUUCZjY/UURTbaiceGUlzFr0qOnZEcsx8VLJSYMSMqqD:S3kUjJY/fRT+iceGUlzFruZdJSzxqqD

Score
10/10
ratnetwire

Malware Config

Extracted

Family

netwire

C2

37.0.14.214:3346

37.0.14.214:4478

37.0.14.214:3469

37.0.14.214:3565
Attributes
  • activex_autorun

    false

  • copy_executable

    true

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • install_path

    %AppData%\Install\Host.exe

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    true

  • offline_keylogger

    true

  • password

    move4ward

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 1 IoCs
    rat
  • Netwire family
    netwire

Files

  • 1872-66-0x0000000000400000-0x0000000000433000-memory.dmp
    .exe windows x86


    Headers

    Sections