Overview

overview

10

Static

static

10

2124-133-0...ry.exe

windows7-x64

1

2124-133-0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    2124-133-0x0000000000400000-0x000000000044F000-memory.dmp

  • Size

    316KB

  • MD5

    7432aeb541f08ae924c2ab094b754169

  • SHA1

    15210ba725a694e8508444148554cdb4876f6f43

  • SHA256

    4c843c667efe882ff40eb0e6841d352d9a1e1cf3a24598f089b7489a110d36dd

  • SHA512

    d48645cf5ecc34ee3b45dbbf8bd7fbfdf5093074c6e5d0feb9756f0ef1291cd2e03623aaa1931f66d3d921b52e6c12c3de4523d18830cc51d58392d0fc2e8e7d

  • SSDEEP

    6144:wcCmiQfipBKWzkeHrb08rTj6aBpSYdS1wjzcoeqqD9GF4Ix:wcXiQfipPrb08rTj6+pGWq4dx

Score
10/10
ratnetwire

Malware Config

Extracted

Family

netwire

C2

19ap22.duckdns.org:3333

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    Jan9

  • lock_executable

    false

  • mutex

    xIxGEcbP

  • offline_keylogger

    false

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 1 IoCs
    rat
  • Netwire family
    netwire

Files

  • 2124-133-0x0000000000400000-0x000000000044F000-memory.dmp
    .exe windows x86


    Headers

    Sections