Overview

overview

10

Static

static

10

PolarisTri...ip.dll

windows10-2004-x64

1

PolarisTri...I2.dll

windows10-2004-x64

1

PolarisTri...ge.exe

windows10-2004-x64

1

PolarisTri...er.dll

windows10-2004-x64

1

PolarisTri...al.exe

windows10-2004-x64

10

PolarisTri...es.dll

windows10-2004-x64

1

PolarisTri...er.dll

windows10-2004-x64

1

PolarisTri...on.dll

windows10-2004-x64

1

PolarisTri...rs.dll

windows10-2004-x64

1

PolarisTri...ce.dll

windows10-2004-x64

1

PolarisTri...ta.dll

windows10-2004-x64

1

PolarisTri...ry.dll

windows10-2004-x64

1

PolarisTri...rs.dll

windows10-2004-x64

1

PolarisTri...fe.dll

windows10-2004-x64

1

PolarisTri...eb.dll

windows10-2004-x64

1

PolarisTri...on.dll

windows10-2004-x64

1

PolarisTri...ls.dll

windows10-2004-x64

1

PolarisTri...ns.dll

windows10-2004-x64

1

PolarisTri...le.dll

windows10-2004-x64

1

PolarisTri...as.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    504s
  • max time network
    508s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    21-01-2023 10:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PolarisTrial/PolarisTrial.exe

  • Size

    5.5MB

  • MD5

    36e404e81aa3f4682eedf6536507d91b

  • SHA1

    116a1aaa2e4a06cb97395225ccabe6b0d66e4be6

  • SHA256

    2cc249a2be6c8f60714f21e8d0b4d4dc6cbda4cde7acfbfbfc1fca9e93778d84

  • SHA512

    85cadf3b80c69e4e1b8b81b1c9ea45722c7aa14d2ece3950b762c2cc350805c8f2bd80ba9ab71d2f7c58046cb6f0d0be3f1dae77962c14125cc8a5feef439746

  • SSDEEP

    98304:eDVp+Z/vQvvPn/pPBwYOb79BD+17rpEd6R3ubV3SDfJtLzlkCAdsOuwrGfhaFEti:eDVp+Z/vQvvPn/puZBD+17rpEd6R3ubL

Score
10/10
netwirebotnetratstealer

Malware Config

Signatures

  • NetWire RAT payload 1 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

Processes

  • C:\Users\Admin\AppData\Local\Temp\PolarisTrial\PolarisTrial.exe
    "C:\Users\Admin\AppData\Local\Temp\PolarisTrial\PolarisTrial.exe"
    1⤵
      PID:4880

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4880-132-0x0000000000CE0000-0x000000000125C000-memory.dmp
      Filesize

      5.5MB

      Download
    • memory/4880-133-0x0000000005C70000-0x0000000005D0C000-memory.dmp
      Filesize

      624KB

      Download
    • memory/4880-134-0x00000000062C0000-0x0000000006864000-memory.dmp
      Filesize

      5.6MB

      Download
    • memory/4880-135-0x0000000005D10000-0x0000000005DA2000-memory.dmp
      Filesize

      584KB

      Download
    • memory/4880-136-0x0000000005C10000-0x0000000005C1A000-memory.dmp
      Filesize

      40KB

      Download
    • memory/4880-137-0x0000000005F10000-0x0000000005F66000-memory.dmp
      Filesize

      344KB

      Download
    • memory/4880-138-0x0000000006870000-0x0000000006A70000-memory.dmp
      Filesize

      2.0MB

      Download