netwire

General

Target
9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d
Size 341KB
Sample220226-h5597sbbem
SHA256 9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d
MD5 b864067e3fa697652752fcd54f2b0621
SHA1 b9c2af989e2a4665df92e734bf7e1894ad9b873f
SHA512 6e37f92c0833881d8a533e5d696d536af4c10b0b835f5c65d979961a07784ea70ca9ae2942248a32251a892eef296e6c5f9f19ebf71d373320cb5e78a1d8eac5
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

netwire

C2

185.244.29.161:1591

Attributes

activex_autorun
false
activex_key
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
NeiqFfto
offline_keylogger
true
password
Password
registry_autorun
false
startup_name
use_mutex
true

Targets

- Target
  9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d
- Size 341KB
- SHA256 9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d
- MD5 b864067e3fa697652752fcd54f2b0621
- SHA1 b9c2af989e2a4665df92e734bf7e1894ad9b873f
- SHA512 6e37f92c0833881d8a533e5d696d536af4c10b0b835f5c65d979961a07784ea70ca9ae2942248a32251a892eef296e6c5f9f19ebf71d373320cb5e78a1d8eac5
- MD5 SHA1 SHA512
Score

10^/10

netwire botnet rat stealer
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

NetWire RAT payload

Suspicious use of NtCreateProcessExOtherParentProcess

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2