General

  • Target

    548-68-0x0000000000400000-0x0000000000420000-memory.dmp

  • Size

    128KB

  • MD5

    1b666262d4cf87b320c03d638784a168

  • SHA1

    1886d498835bba95d7d21904c7605b8fd7fc54b1

  • SHA256

    17e4159a9c87cf7f864f5cea45b79bf54bd913be4c4d542c23364b8daed57ff8

  • SHA512

    443ac9fac51ee3888f7014f53d006ce97371b516212747afba49738052a28d1dee4a0ce5996709a3969ba3446041fc5983699a4392a98d48f1a72e82746284d9

  • SSDEEP

    1536:b2giUJrMJvmpUMyB43RWKRaQ71XubjyKhkkIs1ZZsNIT/ODhw:b2LiQmpUbB4kKP1Xubjy4Is1ZwIgw

Score
10/10

Malware Config

Extracted

Family

netwire

C2

sosclient.duckdns.org:9002

Attributes
  • activex_autorun

    true

  • activex_key

    {OTGC73Q0-N4WA-4861-311L-BE075477ANH7}

  • copy_executable

    false

  • delete_original

    false

  • host_id

    08-%Rand%

  • lock_executable

    true

  • mutex

    stostmDW

  • offline_keylogger

    false

  • password

    10203010Aa

  • registry_autorun

    true

  • startup_name

    Windows defender

  • use_mutex

    true

Signatures

  • NetWire RAT payload 1 IoCs
  • Netwire family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 548-68-0x0000000000400000-0x0000000000420000-memory.dmp
    .exe windows x86


    Headers

    Sections