General
-
Target
811227a58fc1bf2bc0bd43ce924c363e3efcae6c7a466f2617793d9d2d4ca942
-
Size
955KB
-
Sample
220521-mjxhdsbgh9
-
MD5
4666415fc65e06af2d44c98fe5784983
-
SHA1
b67eec7f584755084728733c99b9e9e22cae11cc
-
SHA256
811227a58fc1bf2bc0bd43ce924c363e3efcae6c7a466f2617793d9d2d4ca942
-
SHA512
aa9187a130a66f92c01cca6b769bd835b1e0d9cb45f8799a492f3306e8beca72372fa67d19a557480f925a9b1786b5434511a1c0a9290970662c7e9ba4152100
Static task
static1
Behavioral task
behavioral1
Sample
Proof of Payment.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Proof of Payment.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
netwire
194.5.98.225:3373
194.5.98.225:3376
-
activex_autorun
false
- activex_key
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
- install_path
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
- mutex
-
offline_keylogger
true
-
password
good01230123
-
registry_autorun
false
- startup_name
-
use_mutex
false
Targets
-
-
Target
Proof of Payment.exe
-
Size
1.1MB
-
MD5
5c145bcd4ec07ab79558d72affbed677
-
SHA1
85cc76ba184adde81799ef4174d2412aba7c8dfd
-
SHA256
90bb157f9c5241f567eb56be38e3ba9f51a0ec5a8da3c77fdb1bed1f2095c39b
-
SHA512
24c11205a6ac4470890e68111d2a398dd60e76201ecf8f5f9c7069f76d818a432b5ae48279c2711070c7788afe8508d6983afe5fa41038fd38da9689b83691bd
Score10/10-
NetWire RAT payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-