General
-
Target
order.zip
-
Size
706KB
-
Sample
210721-mhwe1es53n
-
MD5
edded1e2382bd3fa5b966f3067690cc1
-
SHA1
04e0cdfce4fa87ec822736d77090e7eea2fc435c
-
SHA256
497b04efe79c9dce8bb75a37d72702eb9b703912994c5351a6792a8c217160c9
-
SHA512
69d1e3afbc831e7aa69aeaa32abb5438a4f6306907fd94fadc25bd9d04368b6db111c271fb37e935e0d8c4e9f48e687eda74c7b92c0b3804253c447265f465c1
Static task
static1
Behavioral task
behavioral1
Sample
order.exe
Resource
win7v20210410
Malware Config
Extracted
netwire
84.38.129.130:19891
-
activex_autorun
false
- activex_key
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
iFwvrEFs
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
- startup_name
-
use_mutex
true
Targets
-
-
Target
order.exe
-
Size
838KB
-
MD5
587f6655380282c9fb7997fa2225438e
-
SHA1
5b45eb58ef1d1cd93df0ecfc7b4124644515e93c
-
SHA256
9add495b9373ca17ea4f158da84a200f3d5a52ce81bc535a575a5eac31bd76bb
-
SHA512
1b97c465d355d8fa6355c7b856ba7eebac8b8c4bdd9c482b1a8fa6c558309356cfb80ac3373737b269c1ca9c4df03294daee918a34500e45874c1b6fc32ce488
-
NetWire RAT payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-