Overview

overview

10

Static

static

1

3777a3e8d9...73.exe

windows7_x64

10

3777a3e8d9...73.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3777a3e8d9718ad94254a20ae962f68a513da63668d8621c2b93a4a582ca9573

  • Size

    149KB

  • Sample

    220625-276tashhf2

  • MD5

    9128ba0138be09b05ea45364e482d01d

  • SHA1

    94b47559d6367e2f02f0002810f4cb9cee339fa1

  • SHA256

    3777a3e8d9718ad94254a20ae962f68a513da63668d8621c2b93a4a582ca9573

  • SHA512

    d677b5db63a188978ebd31ca5a839eedc60f6033cc13839b4df9a067afd85cbf652f1e1d9b66dcb2e699edd5b60b179c9462f74f5b389b80d5381c78a3f56db9

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      3777a3e8d9718ad94254a20ae962f68a513da63668d8621c2b93a4a582ca9573

    • Size

      149KB

    • MD5

      9128ba0138be09b05ea45364e482d01d

    • SHA1

      94b47559d6367e2f02f0002810f4cb9cee339fa1

    • SHA256

      3777a3e8d9718ad94254a20ae962f68a513da63668d8621c2b93a4a582ca9573

    • SHA512

      d677b5db63a188978ebd31ca5a839eedc60f6033cc13839b4df9a067afd85cbf652f1e1d9b66dcb2e699edd5b60b179c9462f74f5b389b80d5381c78a3f56db9

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks