General

  • Target

    report..vbs

  • Size

    2KB

  • Sample

    210623-aw925mp6ks

  • MD5

    70308f16ec6aed9b2bb1de2b95c954fc

  • SHA1

    72650195a77260155859baa82f82f1b292e5ecff

  • SHA256

    699f259d3ca7ab69da25404cdcf081233a956203ea995dff657f8c2114dba50c

  • SHA512

    0bc476523ae086734f33c74db1ab6fc1e581818c985973e219120b40a950c51c6737e538e68f7bfd6e4b5258a6ce2a682356287af155ef549dae5e794c6ed162

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://ia601401.us.archive.org/25/items/bypass_obbv/bypass_obbv.TXT

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://ia601505.us.archive.org/17/items/server-uybb/Server_uybb.txt

Extracted

Family

netwire

C2

185.19.85.172:1723

Attributes
  • activex_autorun

    false

  • activex_key

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • install_path

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    false

  • startup_name

  • use_mutex

    false

Targets

    • Target

      report..vbs

    • Size

      2KB

    • MD5

      70308f16ec6aed9b2bb1de2b95c954fc

    • SHA1

      72650195a77260155859baa82f82f1b292e5ecff

    • SHA256

      699f259d3ca7ab69da25404cdcf081233a956203ea995dff657f8c2114dba50c

    • SHA512

      0bc476523ae086734f33c74db1ab6fc1e581818c985973e219120b40a950c51c6737e538e68f7bfd6e4b5258a6ce2a682356287af155ef549dae5e794c6ed162

    • NetWire RAT payload

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks