netwire | e48cd864249f52151b995c1cb9143fe99c0533bf4f89eba8d9b7b596abcfc404

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 11:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_4150a3ccbd89c7f2aba53ec081124330_agent-tesla_elex_maze_netwire_remcos_xloader.exe
Size 1.5MB
Sample260801-m6c29sysbt
SHA256 e48cd864249f52151b995c1cb9143fe99c0533bf4f89eba8d9b7b596abcfc404
MD5 4150a3ccbd89c7f2aba53ec081124330
SHA1 5eaefaeef01f6afa45413275347a0cec435770f5
SHA512 fb1a782b8298b88a2ce5b700b9f57661a8564d59e5df980bf0399260f4f63e1e3a410d8fb41b66259bc4e0640486a9e43d08cf715b1885de00f0858f6168c65e
SSDEEP 24576:wXjKjEp2ZC8qDGdjFwpWHB7A18a20W4njUprvVcC1f2o5RRfWLymt:NjEpcC8UM6MHB7AS1rd1f26RuLnt
TLSH
T1A475AD82F39E82F0DE126172793DF73A5E3B2C254530BD466FC5ED36AE211A2111DA93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet netwire rat stealer upx

Malware Config

Signatures

Family: Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/4736-0-0x0000000000AC0000-0x0000000000C47000-memory.dmp	netwire
behavioral1/memory/4736-1-0x0000000000AC0000-0x0000000000C47000-memory.dmp	netwire

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/memory/4736-0-0x0000000000AC0000-0x0000000000C47000-memory.dmp	UPX
behavioral1/memory/4736-1-0x0000000000AC0000-0x0000000000C47000-memory.dmp	UPX

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/4736-0-0x0000000000AC0000-0x0000000000C47000-memory.dmp	autoit_exe
behavioral1/memory/4736-1-0x0000000000AC0000-0x0000000000C47000-memory.dmp	autoit_exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4736-0-0x0000000000AC0000-0x0000000000C47000-memory.dmp	upx
behavioral1/memory/4736-1-0x0000000000AC0000-0x0000000000C47000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4008	4736	WerFault.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-08-01_4150a3ccbd89c7f2aba53ec081124330_agent-tesla_elex_maze_netwire_remcos_xloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_4150a3ccbd89c7f2aba53ec081124330_agent-tesla_elex_maze_netwire_remcos_xloader.exe"
1⤵
PID:4736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 220
  2⤵
  - Program crash
  PID:4008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4736 -ip 4736
1⤵
PID:4740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4736-0-0x0000000000AC0000-0x0000000000C47000-memory.dmp

Download

memory/4736-1-0x0000000000AC0000-0x0000000000C47000-memory.dmp