netwire | 548-66-0x0000000000400000-0x000000000044F000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

548-66-0x0000000000400000-0x000000000044F000-memory.dmp
Size

316KB
MD5

e429d134c2b7dc97bef127ff81e12a5f
SHA1

1433a8fd9df7004f8482070f8e2aef506ddd6bea
SHA256

695dadb4be211b078b091d9a8ae6d685822d2d03c6ec45e76093f37562adeff7
SHA512

f2424d4b6b3491bd69a70c60f015df722a6effb8ad47a6d11d505954e6daf30303d26ff11cd4776a4dea0cc8c817b00972b49239b9c3024a258005653bee4e63
SSDEEP

6144:wcCmiQfipBKWzkeHrb08rTj6aBpSYdS1wjzcoRqqD9kgIx:wcXiQfipPrb08rTj6+pGhq+bx

Score

10^/10

rat netwire

Malware Config

Extracted

Family

netwire

C2

85.31.46.78:3340

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
azaman
lock_executable
false
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 1 IoCs

resource	yara_rule
sample	netwire

Netwire family
netwire

Files

548-66-0x0000000000400000-0x000000000044F000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ