netwire | f61a7fa3ca28133a6fcefa0e04b0de4dc1e4020a87388b4b3a315dc8dc18194e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 14:25

Target

f61a7fa3ca28133a6fcefa0e04b0de4dc1e4020a87388b4b3a315dc8dc18194e.exe
Size

84KB
MD5

a37c6527cabbbaf1e4aa9674b0476069
SHA1

32ce4f91b5ab0da2e1d290164636b2a0dfb46523
SHA256

f61a7fa3ca28133a6fcefa0e04b0de4dc1e4020a87388b4b3a315dc8dc18194e
SHA512

cdbe9010ef3cf60e065dea9684b650cdfb8164c59f50c7c01dae0824abeb161e18f270b29ec3c1d678106d1a5c3ac9d1f08f7f17b337d749679a09aeec903379
SSDEEP

1536:Jr/zIEc9uQ1q1vD9qrPP+r4MrdN/F+Xs6ibNqiRGWkxuATdWTza:Jr/zIEyQIrPP+r4MrdN/086ibgqGWkzR

Score

10^/10

Family

netwire

23.95.88.13:3360

Attributes

activex_autorun
true
activex_key
{3GYL0VK1-5SB1-4X20-W6B8-PQP7L2B50166}
copy_executable
true
delete_original
true
host_id
HostId-yaq2Oq
install_path
%AppData%\Install\Host.exe
keylogger_dir
C:\Documents and Settings\Administrator\Application Data\Logs\
lock_executable
false
offline_keylogger
true
password
doctor
registry_autorun
true
startup_name
system
use_mutex
false

NetWire RAT payload 2 IoCs
rat

Processes:

resource yara_rule

behavioral2/memory/1428-0-0x0000000000400000-0x000000000041E000-memory.dmp netwire
behavioral2/memory/1428-1-0x0000000000400000-0x000000000041E000-memory.dmp netwire
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2980 1428 WerFault.exe f61a7fa3ca28133a6fcefa0e04b0de4dc1e4020a87388b4b3a315dc8dc18194e.exe

resource	yara_rule
behavioral2/memory/1428-0-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/1428-1-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

pid	pid_target	process	target process
2980	1428	WerFault.exe	f61a7fa3ca28133a6fcefa0e04b0de4dc1e4020a87388b4b3a315dc8dc18194e.exe

C:\Users\Admin\AppData\Local\Temp\f61a7fa3ca28133a6fcefa0e04b0de4dc1e4020a87388b4b3a315dc8dc18194e.exe
"C:\Users\Admin\AppData\Local\Temp\f61a7fa3ca28133a6fcefa0e04b0de4dc1e4020a87388b4b3a315dc8dc18194e.exe"
1⤵
PID:1428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 376
2⤵
- Program crash
PID:2980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1428 -ip 1428
1⤵
PID:2504

memory/1428-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1428-1-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download