netwire | a037f3917e324824178e239b7b5ae1ffa3dd99fe9dee821041de9404566e0271

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_728279798a7f476b90eb845e4d548152_agent-tesla_elex_maze_netwire_remcos_xloader.exe
Size 1.5MB
Sample261027-ryqqlssv3j
SHA256 a037f3917e324824178e239b7b5ae1ffa3dd99fe9dee821041de9404566e0271
MD5 728279798a7f476b90eb845e4d548152
SHA1 1c379eec7b87f9142418f313f0d46775fc1abc3d
SHA512 ad3b6f055c1a6c0418e8dbbad987e9d9ac7dd7cd3a39f991eb35c814e12cbf022eb78706891d243bf8095eeafda1a6acb723ab72d7834b335f769d6fcbcdc100
SSDEEP 24576:yEVOjplM2HijuZ3ghQp6YM23Y20W4njUprvVcC1f2o5RRfWLmTt:OzM2CW6c6YMGfrd1f26RuLit
TLSH
T1FC75BE92E39D81F0DE1261B2787DF73A5E3B6C648534BD4A6FC5EC36BD21022111DAA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet netwire rat stealer upx

Malware Config

Signatures

Family: Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/4016-0-0x0000000000E10000-0x0000000000F97000-memory.dmp	netwire
behavioral1/memory/4016-1-0x0000000000E10000-0x0000000000F97000-memory.dmp	netwire

Custom signature

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/memory/4016-0-0x0000000000E10000-0x0000000000F97000-memory.dmp	UPX
behavioral1/memory/4016-1-0x0000000000E10000-0x0000000000F97000-memory.dmp	UPX

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/4016-0-0x0000000000E10000-0x0000000000F97000-memory.dmp	autoit_exe
behavioral1/memory/4016-1-0x0000000000E10000-0x0000000000F97000-memory.dmp	autoit_exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4016-0-0x0000000000E10000-0x0000000000F97000-memory.dmp	upx
behavioral1/memory/4016-1-0x0000000000E10000-0x0000000000F97000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3872	4016	WerFault.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-10-26_728279798a7f476b90eb845e4d548152_agent-tesla_elex_maze_netwire_remcos_xloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_728279798a7f476b90eb845e4d548152_agent-tesla_elex_maze_netwire_remcos_xloader.exe"
1⤵
PID:4016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 208
  2⤵
  - Program crash
  PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4016 -ip 4016
1⤵
PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4016-0-0x0000000000E10000-0x0000000000F97000-memory.dmp

Download

memory/4016-1-0x0000000000E10000-0x0000000000F97000-memory.dmp