netwire | e0d701886120107673f19e658cc2985b60110521fd5d6a9955b2f61eee97dc9c

Analysis

max time kernel
60s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2022 03:03

Target

4444-355-0x0000000010550000-0x0000000010585000-memory.exe
Size

212KB
MD5

37c70bf71f672f64d062691d686cbf76
SHA1

e33b498908c22679ae22917ff2164b2446545846
SHA256

e0d701886120107673f19e658cc2985b60110521fd5d6a9955b2f61eee97dc9c
SHA512

80e2922ef48c2e6cb756b2894e855c28692d985ae662538d42a9b7f657362dcfb383735138aa823c0ee4d68a634432d7021849a00c7de0dc154e39a84f2f5107
SSDEEP

6144:Ob6OTcK+NrRioGHlz8rz0i/XzQqqDvFf:OGK+Nr8MrYi/ZqR

Score

10^/10

NetWire RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4808-132-0x0000000000540000-0x0000000000575000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

540 4808 WerFault.exe 4444-355-0x0000000010550000-0x0000000010585000-memory.exe

pid	pid_target	process	target process
540	4808	WerFault.exe	4444-355-0x0000000010550000-0x0000000010585000-memory.exe

C:\Users\Admin\AppData\Local\Temp\4444-355-0x0000000010550000-0x0000000010585000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\4444-355-0x0000000010550000-0x0000000010585000-memory.exe"
1⤵
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 216
2⤵
- Program crash
PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4808 -ip 4808
1⤵
PID:3220

memory/4808-132-0x0000000000540000-0x0000000000575000-memory.dmp

Filesize
212KB

Download