Overview

overview

10

Static

static

Dachser Consul...49.exe

windows7_x64

1

Dachser Consul...49.exe

windows10-2004_x64

10
General
Target

Dachser Consulta de cliente saliente no. 000150849 - SKBMT03082020-0012-IMG0149.exe

Filesize

686KB

Completed

21-05-2022 18:28

Task

behavioral2

Score
10/10
MD5

6998ca30e81c5ae0fda8e67ced0e2cbd

SHA1

3977c48bae879d9f28c741645f7eb1571caf3bcf

SHA256

dfc8f0a7456a2b40908d901c2468d372bd859abda04e50ef4cf45ec84668cdcb

SHA256

ca61bc204bcc8d1dbce6711ca001bef26418163507583689189790459e210363c19b2eec7e360dec1c8fcdd6dc35074a92eee4823628e88d5589b25a00fe42df

Malware Config
Signatures 2

Filter: none

  • NetWire RAT payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/3116-136-0x0000000000AB0000-0x0000000000AE4000-memory.dmpnetwire
  • Netwire

    Description

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    Tags

Processes 1
  • C:\Users\Admin\AppData\Local\Temp\Dachser Consulta de cliente saliente no. 000150849 - SKBMT03082020-0012-IMG0149.exe
    "C:\Users\Admin\AppData\Local\Temp\Dachser Consulta de cliente saliente no. 000150849 - SKBMT03082020-0012-IMG0149.exe"
    PID:3116
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads

                          • memory/3116-130-0x00000000779E0000-0x0000000077B83000-memory.dmp

                            Download

                          • memory/3116-132-0x0000000076F80000-0x0000000077195000-memory.dmp

                            Download

                          • memory/3116-133-0x00000000779E0000-0x0000000077B83000-memory.dmp

                            Download

                          • memory/3116-134-0x0000000076670000-0x0000000076760000-memory.dmp

                            Download

                          • memory/3116-135-0x0000000076F80000-0x0000000077195000-memory.dmp

                            Download

                          • memory/3116-136-0x0000000000AB0000-0x0000000000AE4000-memory.dmp

                            Download