Overview

overview

10

Static

static

8

9cdb3ec1ac...2b.exe

windows7_x64

10

9cdb3ec1ac...2b.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9cdb3ec1accd17e884e8ed76d8789b2b

  • Size

    459KB

  • Sample

    201117-r2dac44wsx

  • MD5

    95b26096376f1a1624581f3203a05f4d

  • SHA1

    5e885913d272cb5912bd2bbb1f84be93ac09bf52

  • SHA256

    3cb34cca32bb4aea5625d0760bd6c51f71695c7bb2c11e465c24a31efbfba6cf

  • SHA512

    c49bb53a7e180761011fad7f3b987ced91e52715bc27382c7600d086bfbcb893c21361028941b29b2fb0e6abe2da47a79a222098efc8801ed6f218def7599f53

Score
10/10
netwirebotnetpersistenceratstealerupx

Malware Config

Targets

    • Target

      9cdb3ec1accd17e884e8ed76d8789b2b

    • Size

      459KB

    • MD5

      95b26096376f1a1624581f3203a05f4d

    • SHA1

      5e885913d272cb5912bd2bbb1f84be93ac09bf52

    • SHA256

      3cb34cca32bb4aea5625d0760bd6c51f71695c7bb2c11e465c24a31efbfba6cf

    • SHA512

      c49bb53a7e180761011fad7f3b987ced91e52715bc27382c7600d086bfbcb893c21361028941b29b2fb0e6abe2da47a79a222098efc8801ed6f218def7599f53

    Score
    10/10
    netwirebotnetpersistenceratstealerupx

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks