Overview

overview

10

Static

static

8

remittance...ec.xls

windows7_x64

10

remittance...ec.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    remittance for the month of Dec.xls

  • Size

    238KB

  • Sample

    201222-mpqkg3m6e2

  • MD5

    2630facfc34c2f673ed8df90e6605c56

  • SHA1

    2c462db9f695db91d9c61d961f8a7ddb48d62b57

  • SHA256

    49638c7502de579d5d7afa8081710d51193fb91b96055283a3af8b28b4e0721e

  • SHA512

    7d1f5c107341321005b9a9dc3b2b166fc8af34f9202bb865172a03e328391741eb827104c4418ba2fd093286090ff2d82518a5bf083b7b59e3701b297890f8a9

Score
10/10
netwirebotnetmacropersistenceratstealer

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://45.15.143.142/fa.exe

Targets

    • Target

      remittance for the month of Dec.xls

    • Size

      238KB

    • MD5

      2630facfc34c2f673ed8df90e6605c56

    • SHA1

      2c462db9f695db91d9c61d961f8a7ddb48d62b57

    • SHA256

      49638c7502de579d5d7afa8081710d51193fb91b96055283a3af8b28b4e0721e

    • SHA512

      7d1f5c107341321005b9a9dc3b2b166fc8af34f9202bb865172a03e328391741eb827104c4418ba2fd093286090ff2d82518a5bf083b7b59e3701b297890f8a9

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks