Overview

overview

10

Static

static

10

5024-151-0...ry.exe

windows7-x64

1

5024-151-0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5024-151-0x0000000000400000-0x0000000000433000-memory.dmp

  • Size

    204KB

  • MD5

    b0fbd43d69a2a263d291b19bde7fa082

  • SHA1

    27f2f726ad9da9e43879cb15d4c56efd0d487860

  • SHA256

    ba548b57bd056e3c9f765063e51eb15fff729710cd499fcbe9d934790694a09d

  • SHA512

    5d9b9f2fa1a83625233bbd3004781cc424d5e00ffeb2e1cb5d4d1fd1df132edcdfa7487516f540d2d87625dee828cab8d7163be1ad9a31e6aa1f7c7ad12c517b

  • SSDEEP

    3072:jOzPcXa+ND32eioGHlz8rnAE0HCXh0edLvhYMjMqqDvFf:jOTcK+NrRioGHlz8rz0i/hzQqqDvFf

Score
10/10
ratnetwire

Malware Config

Extracted

Family

netwire

C2

37.0.14.206:3384

Attributes
  • activex_autorun

    false

  • copy_executable

    true

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • install_path

    %AppData%\Install\Host.exe

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    true

  • offline_keylogger

    true

  • password

    Password234

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 1 IoCs
    rat
  • Netwire family
    netwire

Files

  • 5024-151-0x0000000000400000-0x0000000000433000-memory.dmp
    .exe windows x86


    Headers

    Sections