Overview

overview

10

Static

static

First Orde...22.exe

windows7_x64

10

First Orde...22.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    First Order 1050522.exe

  • Size

    23KB

  • Sample

    220505-vf8p9agdc5

  • MD5

    0a5658ae9bc75b17d7d591f8411c2b89

  • SHA1

    97a8540c7b213ab33231735e73a01f0903e51182

  • SHA256

    791b2bf682699cf97e3925dee40ddd5c2cb728e80f798225a7fb0b713c1b1544

  • SHA512

    bdcdda71261c750be6c59bfc7daeb113a7d0550fb189941e234189b49b5d4058cee359813ace409045db3cf3c4bef24842fb2a15d0d211ffee939713730cc3d0

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      First Order 1050522.exe

    • Size

      23KB

    • MD5

      0a5658ae9bc75b17d7d591f8411c2b89

    • SHA1

      97a8540c7b213ab33231735e73a01f0903e51182

    • SHA256

      791b2bf682699cf97e3925dee40ddd5c2cb728e80f798225a7fb0b713c1b1544

    • SHA512

      bdcdda71261c750be6c59bfc7daeb113a7d0550fb189941e234189b49b5d4058cee359813ace409045db3cf3c4bef24842fb2a15d0d211ffee939713730cc3d0

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • Modifies WinLogon for persistence

      persistence

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks