Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
28/12/2023, 21:08
General
-
Target
f843b4d0ab8c3fd3eda5991b9521fd0d.exe
-
Size
1007KB
-
MD5
f843b4d0ab8c3fd3eda5991b9521fd0d
-
SHA1
000fdbefcf5cdd837ff0386817c5965c80ae880c
-
SHA256
67aad5a6b746230f56aefe03cd16e2738cc5422536601483631732b3af8fd4c9
-
SHA512
2e9ec0da3c1c7797b54836af96fd1d352cd14a0dce8d478fae21a9820887909192681d7eadf08099c55927ccfd2f1642077367d13558b57b935771081ebc201d
-
SSDEEP
6144:q2hFHKRsR0OudRUJ7b+d/hdNH0eQZoALkjwoEuJfio46q:q2h9VKK7b2ln/pJfr
Score
10/10
Malware Config
Extracted
Family
netwire
C2
netnetwir.duckdns.org:26661
netw.covid19.co.no:26661
Attributes
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
netw-%dhjetor%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
qw12qw12
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 3 IoCs
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f843b4d0ab8c3fd3eda5991b9521fd0d.exe"C:\Users\Admin\AppData\Local\Temp\f843b4d0ab8c3fd3eda5991b9521fd0d.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1020KB
-
Filesize
1020KB
-
Filesize
1020KB
-
Filesize
1020KB