Overview

overview

10

Static

static

417b4a38ff...71.exe

windows7_x64

10

417b4a38ff...71.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    417b4a38fff2e60e2a4178bd99f6a7c41e3e1ddd6c4a1384982c7907e952b671

  • Size

    879KB

  • Sample

    210228-k25z87ycye

  • MD5

    b9c4eb9e4f25e6a069d6f4045e5f287f

  • SHA1

    097022888985aafaf745dbf018b1ce7ed3056d11

  • SHA256

    417b4a38fff2e60e2a4178bd99f6a7c41e3e1ddd6c4a1384982c7907e952b671

  • SHA512

    dcf56268a85a47f7b223473b2ed8c55e55a480ba655ad958c7206e0ab5d6a953853ea0e224e50db999e6fc8724d4d21f0e3b406923c4cb79219822614e207cae

Score
10/10
netwirebootkitbotnetpersistenceratstealerupx

Malware Config

Targets

    • Target

      417b4a38fff2e60e2a4178bd99f6a7c41e3e1ddd6c4a1384982c7907e952b671

    • Size

      879KB

    • MD5

      b9c4eb9e4f25e6a069d6f4045e5f287f

    • SHA1

      097022888985aafaf745dbf018b1ce7ed3056d11

    • SHA256

      417b4a38fff2e60e2a4178bd99f6a7c41e3e1ddd6c4a1384982c7907e952b671

    • SHA512

      dcf56268a85a47f7b223473b2ed8c55e55a480ba655ad958c7206e0ab5d6a953853ea0e224e50db999e6fc8724d4d21f0e3b406923c4cb79219822614e207cae

    Score
    10/10
    netwirebootkitbotnetpersistenceratstealerupx

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks