Overview

overview

10

Static

static

Second Ord...cr.exe

windows7_x64

10

Second Ord...cr.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Second Order 050522.scr.exe

  • Size

    23KB

  • Sample

    220505-vf8p9abahk

  • MD5

    028e3a8a96adf5e51fb571ff91a602e4

  • SHA1

    272e32f9d6f9585439a2abe6b60737198cd40195

  • SHA256

    089c37a0afa3e281d1784c54442e67572690496a7795f28d93fa9cc3284e93c4

  • SHA512

    49a5befdcae505cf5a13bdd9fcd3993db9462f53f7b127a381a62f8b369304dfc1094d16694b4322ceea29ee02e2f9b4676a93818c5f1c7fc9fcc63ef8749dc2

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Extracted

Family

netwire

C2

gracedynu.gleeze.com:4040

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    @#%$

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      Second Order 050522.scr.exe

    • Size

      23KB

    • MD5

      028e3a8a96adf5e51fb571ff91a602e4

    • SHA1

      272e32f9d6f9585439a2abe6b60737198cd40195

    • SHA256

      089c37a0afa3e281d1784c54442e67572690496a7795f28d93fa9cc3284e93c4

    • SHA512

      49a5befdcae505cf5a13bdd9fcd3993db9462f53f7b127a381a62f8b369304dfc1094d16694b4322ceea29ee02e2f9b4676a93818c5f1c7fc9fcc63ef8749dc2

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • Modifies WinLogon for persistence

      persistence

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks