Overview

overview

10

Static

static

984ebe40c1...9a.exe

windows7_x64

10

984ebe40c1...9a.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    984ebe40c1ff8949b2e986bacd2b899a.exe

  • Size

    921KB

  • Sample

    201213-6nmpdq14pe

  • MD5

    984ebe40c1ff8949b2e986bacd2b899a

  • SHA1

    5e1af59384fcaa30eb0185034fe21209cecb05df

  • SHA256

    17a31e5e4c46ce8f7c0e242a5e90c8d6cef5db6d77b696b93af45b1b22a87d81

  • SHA512

    d3893e713ba6e2f1e29ec40b6df50eb26f2027c58485cad8f87dc5631e08486adbef51c8f8d614e0fef8977545472db9a0adba3ec21d5a9422e61691254826e6

Score
10/10
netwirebotnetevasionpersistenceratstealer

Malware Config

Targets

    • Target

      984ebe40c1ff8949b2e986bacd2b899a.exe

    • Size

      921KB

    • MD5

      984ebe40c1ff8949b2e986bacd2b899a

    • SHA1

      5e1af59384fcaa30eb0185034fe21209cecb05df

    • SHA256

      17a31e5e4c46ce8f7c0e242a5e90c8d6cef5db6d77b696b93af45b1b22a87d81

    • SHA512

      d3893e713ba6e2f1e29ec40b6df50eb26f2027c58485cad8f87dc5631e08486adbef51c8f8d614e0fef8977545472db9a0adba3ec21d5a9422e61691254826e6

    Score
    10/10
    netwirebotnetevasionpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Modifies Installed Components in the registry

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

2
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks