General
-
Target
101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0
-
Size
137KB
-
Sample
220604-qpnzzshbb4
-
MD5
65d209ca2059c2246557a4e01e018ba8
-
SHA1
b7bf68ef1f74e33b530025cca086fa503c1c9e15
-
SHA256
101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0
-
SHA512
6bcd1f5cd9c009e5c23614a8d5f470e34d7f825a8322402e935b58018c8aae3ecc8d229f98ecc8b73606c4216e30866ed5362e48442ffd844f378a27dbc09529
Static task
static1
Behavioral task
behavioral1
Sample
101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0
-
Size
137KB
-
MD5
65d209ca2059c2246557a4e01e018ba8
-
SHA1
b7bf68ef1f74e33b530025cca086fa503c1c9e15
-
SHA256
101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0
-
SHA512
6bcd1f5cd9c009e5c23614a8d5f470e34d7f825a8322402e935b58018c8aae3ecc8d229f98ecc8b73606c4216e30866ed5362e48442ffd844f378a27dbc09529
Score10/10-
NetWire RAT payload
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-