Extracted

• • Target
    Invoice.xlsm
  • Size 399KB
  • SHA256 ff4386a4ec4746d085fe2fa9cf974f39334fa3c64b27b2ab88468ea72c898fb2
  • MD5 f7b59e2d235fee9ba12ec42df07ce2b5
  • SHA1 587fa2772cd69bf5d136d9f459fd01a4db65e9ba
  • SHA512 48344cc1b929d2a9cd3f5a713743c75b6591f0284ea8fae5f7995e49ddd5df4deba9a0070106f83751af835e61cce059097037c778b16153bcf9cb4de5206d9f
  • MD5 SHA1 SHA512

  Score

  10^/10

  ratbotnetstealernetwire

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Blacklisted process makes network request

  • Executes dropped EXE

  • Drops startup file

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2