Overview

overview

10

Static

static

173732c415...17.exe

windows7_x64

10

173732c415...17.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    173732c4151ba7583010f3f45a610817

  • Size

    126KB

  • Sample

    201117-klk7y1zl8j

  • MD5

    173732c4151ba7583010f3f45a610817

  • SHA1

    e8c6c918565e807e4c52f8af92fee9ee12cd1394

  • SHA256

    27c7e09f3d97d73a998e1cfb8fca499b77b3045797459c7696b924106d2866c6

  • SHA512

    49c84674e3a3cfface9c936fba122ba981a0fcddc691d8c0bfd2ae3b465beb8c5a42c0133ea46d87722bcac4ec2920bfda7534a77f77cd50ce803d62d211c2ce

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      173732c4151ba7583010f3f45a610817

    • Size

      126KB

    • MD5

      173732c4151ba7583010f3f45a610817

    • SHA1

      e8c6c918565e807e4c52f8af92fee9ee12cd1394

    • SHA256

      27c7e09f3d97d73a998e1cfb8fca499b77b3045797459c7696b924106d2866c6

    • SHA512

      49c84674e3a3cfface9c936fba122ba981a0fcddc691d8c0bfd2ae3b465beb8c5a42c0133ea46d87722bcac4ec2920bfda7534a77f77cd50ce803d62d211c2ce

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • ServiceHost packer

      Detects ServiceHost packer used for .NET malware

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks