Overview

overview

10

Static

static

10

984071c005...d7.exe

windows7-x64

10

984071c005...d7.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    127s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    20-04-2023 08:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    984071c0054069029075b43afe125cd12bc3f9f70e384ca023cf70ea76a326d7.exe

  • Size

    9.1MB

  • MD5

    d037a430034a3d80c1ab9573c8c0b5a3

  • SHA1

    abfc45d543920e955b9016dbc2e461ff862a5c7f

  • SHA256

    984071c0054069029075b43afe125cd12bc3f9f70e384ca023cf70ea76a326d7

  • SHA512

    806a41f2ce4821e507ae615a5e501128a6854e3468369010f67a3f70a65bfef18c5c473f6347ecccf997d5d0b2ccce86018fcb2740296718ccda5ba6da0f230b

  • SSDEEP

    196608:y10ZfU3tLT+MeZQ1DTXP2NJEIYJ91TmKmt5p:ymZfU3AZQ1TXwEIYFTnmt

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

s2awscloudupdates.com:8081

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    happy666

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 3 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

Processes

  • C:\Users\Admin\AppData\Local\Temp\984071c0054069029075b43afe125cd12bc3f9f70e384ca023cf70ea76a326d7.exe
    "C:\Users\Admin\AppData\Local\Temp\984071c0054069029075b43afe125cd12bc3f9f70e384ca023cf70ea76a326d7.exe"
    1⤵
      PID:2000

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2000-54-0x0000000000400000-0x0000000000D61000-memory.dmp
      Filesize

      9.4MB

      Download
    • memory/2000-55-0x0000000000340000-0x000000000038F000-memory.dmp
      Filesize

      316KB

      Download
    • memory/2000-56-0x0000000000230000-0x0000000000275000-memory.dmp
      Filesize

      276KB

      Download
    • memory/2000-57-0x0000000000340000-0x000000000038F000-memory.dmp
      Filesize

      316KB

      Download
    • memory/2000-58-0x0000000000400000-0x0000000000D61000-memory.dmp
      Filesize

      9.4MB

      Download