netwire

General

Target
Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe
Size 716KB
Sample220209-mc56ysabcp
SHA256 23d09e266528b3ffbd4fc656743303461b9c8a5780d02e28b666243406915401
MD5 3e160f9c8b0f124888f022b628ac6f7e
SHA1 38349b9299c8a94caad8e2d7f187d5e00cee1abd
SHA512 04c0249212f2fe05c68a09a3e85c52aee03ab929ac6b41ec628a1626fa5af66b5ae6d02f80e9af5b0d77a8553d9676fe2c8e51c5a33b49776e3b3eefe3520bea
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe
- Size 716KB
- SHA256 23d09e266528b3ffbd4fc656743303461b9c8a5780d02e28b666243406915401
- MD5 3e160f9c8b0f124888f022b628ac6f7e
- SHA1 38349b9299c8a94caad8e2d7f187d5e00cee1abd
- SHA512 04c0249212f2fe05c68a09a3e85c52aee03ab929ac6b41ec628a1626fa5af66b5ae6d02f80e9af5b0d77a8553d9676fe2c8e51c5a33b49776e3b3eefe3520bea
- MD5 SHA1 SHA512
Score

10^/10

netwire botnet persistence rat stealer xmrig miner
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

NetWire RAT payload

xmrig

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2