Overview

overview

10

Static

static

PAYMENT NO...ON.exe

windows7_x64

10

PAYMENT NO...ON.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    efbdd19d4daedfae66e2e249acc960dda45cd56bacce785f48dbe62aee4e5186

  • Size

    876KB

  • Sample

    220520-qaj3gscgh4

  • MD5

    575d745dbd25ad7d843655d0ded0ea83

  • SHA1

    8abccd0ee57b6f3d5cbb097066cd5e3446953cf6

  • SHA256

    efbdd19d4daedfae66e2e249acc960dda45cd56bacce785f48dbe62aee4e5186

  • SHA512

    6ab042d140d81aae73ae648cbb03ac2c6c442a53e56553718f31e62691b73e30a5801ec91fbd47ce031a5ba4e92db613a6e5d702ab58d6f812f372c6a6d89275

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      PAYMENT NOTIFICATION.exe

    • Size

      1.0MB

    • MD5

      48f2dd0cfdd0ff30ca7af9f48422d9a5

    • SHA1

      04f0c3b03b5992689197e13e0375be9978fef8df

    • SHA256

      9eb4147d9fa5bdb1ad291e70ba7ff90fd005c2aa21ceaf4af8effbebc5cf4621

    • SHA512

      2eedbf47eaee9410aeb8203904b7fde4b8561e2d93a17b16d48e78ab2db5d26ce26b4694badf107998e724cf3abee4d131416b8e0feaca13b330959d67329161

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks