Overview

overview

10

Static

static

1027075193...a1.exe

windows7_x64

8

1027075193...a1.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10270751935c774658b5a8e956aa9ca1

  • Size

    601KB

  • Sample

    201117-8gqw9gz8pj

  • MD5

    10270751935c774658b5a8e956aa9ca1

  • SHA1

    11b88927bb06b9b661e9cd11c7d08116f64cbf12

  • SHA256

    2b4569753be7e894aff4079e30581195d611e123a77ddb5115e05d15f16ed887

  • SHA512

    80fe034bcbc2a5aeecaab2c54594d399964d4f5ff73ea9f14f8e1a6be1b070ca11dd8e6f38cecd0e61b8a115a2efe8d52fb9767fe2c97967e4046dd3f08d361e

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      10270751935c774658b5a8e956aa9ca1

    • Size

      601KB

    • MD5

      10270751935c774658b5a8e956aa9ca1

    • SHA1

      11b88927bb06b9b661e9cd11c7d08116f64cbf12

    • SHA256

      2b4569753be7e894aff4079e30581195d611e123a77ddb5115e05d15f16ed887

    • SHA512

      80fe034bcbc2a5aeecaab2c54594d399964d4f5ff73ea9f14f8e1a6be1b070ca11dd8e6f38cecd0e61b8a115a2efe8d52fb9767fe2c97967e4046dd3f08d361e

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks