Overview

overview

10

Static

static

PAYMENT_.scr

windows7_x64

10

PAYMENT_.scr

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aba0f23ae3b752463217cbe7b2a9fe5657c88efb740bb42bedd8acb1ddc1028f

  • Size

    3.9MB

  • Sample

    220521-n76xeahhhp

  • MD5

    4df0f5f47b53a43078dfeedb91c833df

  • SHA1

    547348b035e08412e3966ad3d0f8e4ea861d7a1e

  • SHA256

    aba0f23ae3b752463217cbe7b2a9fe5657c88efb740bb42bedd8acb1ddc1028f

  • SHA512

    51b1bcd87e54aef4e0fc0d5a901068f22d5d3b7039d26f5345f0465f60972e62ba860427047da5f22d6ba0998d8c1daa39d416bf17bceb74985a8207f6282162

Score
10/10
netwirebotnetevasionpersistenceratstealertrojan

Malware Config

Extracted

Family

netwire

C2

alkaline.publicvm.com:1777

Attributes
  • activex_autorun

    false

  • activex_key

  • copy_executable

    false

  • delete_original

    false

  • host_id

    home198

  • install_path

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    EEwpRdkL

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    false

  • startup_name

  • use_mutex

    true

Targets

    • Target

      PAYMENT_.SCR

    • Size

      3.3MB

    • MD5

      e379f065a86da6a2a18d295e6c761567

    • SHA1

      70c1118d216adb364d1779f429bb74f62b02e625

    • SHA256

      43ff3fea39b1e9ca2ebc2f714057bb50d14b4c76d46e31ee58ada74ded595eed

    • SHA512

      419e75c799d8b94b28b789573ab15b44c970470e0a0046dd1d5fa28b7529b6dac5f48676b355070fbcaed5c32af0f8c6f1d31f48ad00cc849a88fe8b4ad56a0c

    Score
    10/10
    netwirebotnetevasionpersistenceratstealertrojan

    • Modifies WinLogon for persistence

      persistence

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Drops startup file

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Disabling Security Tools

2
T1089

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

2
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks