Overview

overview

10

Static

static

10

c03d94d692...a3.exe

windows7_x64

10

c03d94d692...a3.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c03d94d692c0b12560728a47aaf0da454ab2a5baaa1d73390b11b31a640e6ca3

  • Size

    106KB

  • Sample

    220701-dlw5zabcf5

  • MD5

    f98dec0b6595181bf61f625453936738

  • SHA1

    160a1f94d281d8fa58057ea9eec2368e4eb4d28e

  • SHA256

    c03d94d692c0b12560728a47aaf0da454ab2a5baaa1d73390b11b31a640e6ca3

  • SHA512

    f58116eca154061d26f33f74183fd57a12d280bb557573a04f886fdf1ea82a1f82e39749ff3670b2a2454cfcc14c55e75c80d6edf9d78a41bcd5dc4ad208ed6d

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      c03d94d692c0b12560728a47aaf0da454ab2a5baaa1d73390b11b31a640e6ca3

    • Size

      106KB

    • MD5

      f98dec0b6595181bf61f625453936738

    • SHA1

      160a1f94d281d8fa58057ea9eec2368e4eb4d28e

    • SHA256

      c03d94d692c0b12560728a47aaf0da454ab2a5baaa1d73390b11b31a640e6ca3

    • SHA512

      f58116eca154061d26f33f74183fd57a12d280bb557573a04f886fdf1ea82a1f82e39749ff3670b2a2454cfcc14c55e75c80d6edf9d78a41bcd5dc4ad208ed6d

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks