netwire | 8da241bd7c4acd31d673b62514c0b17ef61261b30df0817f0e3bc18df1929b13

Analysis

max time kernel
149s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 11:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_60c4f0b0f576bc474c63569b6b3d8418_agent-tesla_elex_maze_netwire_remcos_xloader.exe
Size 1.5MB
Sample260701-n4bxvsds2m
SHA256 8da241bd7c4acd31d673b62514c0b17ef61261b30df0817f0e3bc18df1929b13
MD5 60c4f0b0f576bc474c63569b6b3d8418
SHA1 9d651bd9c696251651f1c00c1e586c7e00ea2888
SHA512 b20b697d15375ea5613128163a58e55312cdd6ae90468964651af61a7d0767178ebec2c4391fa7a8aec5a3e916b85e7a9636e805fb4837fb57243ffd1bfb3f59
SSDEEP 24576:gL3CFhqMGP65Th0lCV34xAS20W4njUprvVcC1f2o5RRfWLqjt:1/qMM8a8V346drd1f26RuLKt
TLSH
T18C75AE62F3DF82F0DE221172B86DE73A6E3B6C250534BD426FC9ED36AD25121111DA93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet netwire rat stealer upx

Malware Config

Signatures

Family: Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/1472-0-0x00000000007F0000-0x0000000000977000-memory.dmp	netwire
behavioral1/memory/1472-1-0x00000000007F0000-0x0000000000977000-memory.dmp	netwire

Custom signature

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/memory/1472-0-0x00000000007F0000-0x0000000000977000-memory.dmp	UPX
behavioral1/memory/1472-1-0x00000000007F0000-0x0000000000977000-memory.dmp	UPX

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1472-0-0x00000000007F0000-0x0000000000977000-memory.dmp	autoit_exe
behavioral1/memory/1472-1-0x00000000007F0000-0x0000000000977000-memory.dmp	autoit_exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1472-0-0x00000000007F0000-0x0000000000977000-memory.dmp	upx
behavioral1/memory/1472-1-0x00000000007F0000-0x0000000000977000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5076	1472	WerFault.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-01_60c4f0b0f576bc474c63569b6b3d8418_agent-tesla_elex_maze_netwire_remcos_xloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_60c4f0b0f576bc474c63569b6b3d8418_agent-tesla_elex_maze_netwire_remcos_xloader.exe"
1⤵
PID:1472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 180
  2⤵
  - Program crash
  PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1472 -ip 1472
1⤵
PID:3596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1472-0-0x00000000007F0000-0x0000000000977000-memory.dmp

Download

memory/1472-1-0x00000000007F0000-0x0000000000977000-memory.dmp