Overview

overview

10

Static

static

5

b325c03e95...in.exe

windows7_x64

10

b325c03e95...in.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b325c03e9582b83c544796f4518fa68b93053b1d21079049f9a8ddf6700a392a.bin

  • Size

    1.2MB

  • Sample

    210719-e1vp3asjpa

  • MD5

    2d619dfd3178ee2ffbcfc488c1211d4f

  • SHA1

    971cf6179b962d3612d0aff277960e0638017401

  • SHA256

    b325c03e9582b83c544796f4518fa68b93053b1d21079049f9a8ddf6700a392a

  • SHA512

    0611fd9ec274528b0b1a993291bfcec35e9aabb54203855b524cccc70e582958686239cce33c1c01427cc5d8a3baeb13d753c03feaf00b856a72742808f0c7fe

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      b325c03e9582b83c544796f4518fa68b93053b1d21079049f9a8ddf6700a392a.bin

    • Size

      1.2MB

    • MD5

      2d619dfd3178ee2ffbcfc488c1211d4f

    • SHA1

      971cf6179b962d3612d0aff277960e0638017401

    • SHA256

      b325c03e9582b83c544796f4518fa68b93053b1d21079049f9a8ddf6700a392a

    • SHA512

      0611fd9ec274528b0b1a993291bfcec35e9aabb54203855b524cccc70e582958686239cce33c1c01427cc5d8a3baeb13d753c03feaf00b856a72742808f0c7fe

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks