netwire | c1e062e933fc6527e29e761d59e2d7d9c3847e78202450d76028aaa2c8d82f6b

Analysis

max time kernel
143s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 03:09

Target

3168-370-0x0000000010560000-0x00000000105B2000-memory.exe
Size

328KB
MD5

82b6c935946049119286ed8516f04924
SHA1

fa8db16d6a13dc907f4c4fda55d03f8887dc1286
SHA256

c1e062e933fc6527e29e761d59e2d7d9c3847e78202450d76028aaa2c8d82f6b
SHA512

b96fbac28686e3747fe12279fe802eb604b2c3d054e0f4fad73e2c5a3ff06e9ae14bf8d8031f3d045dbf1d252aa360da696488dd5b6536ac187128a0475ccabc
SSDEEP

6144:Nbhnot4+sbOAtbkfHLDiT6OzR8Q0l+/NyqRKbhoXqqD8Xi8B:Nlnot4+UwLDiT6OzR8llAgqQB

Score

10^/10

NetWire RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4932-132-0x0000000000550000-0x00000000005A2000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4936 4932 WerFault.exe 3168-370-0x0000000010560000-0x00000000105B2000-memory.exe

pid	pid_target	process	target process
4936	4932	WerFault.exe	3168-370-0x0000000010560000-0x00000000105B2000-memory.exe

C:\Users\Admin\AppData\Local\Temp\3168-370-0x0000000010560000-0x00000000105B2000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\3168-370-0x0000000010560000-0x00000000105B2000-memory.exe"
1⤵
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 192
2⤵
- Program crash
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4932 -ip 4932
1⤵
PID:4996

memory/4932-132-0x0000000000550000-0x00000000005A2000-memory.dmp

Filesize
328KB

Download