Overview

overview

10

Static

static

70441312a8...68.exe

windows7_x64

10

70441312a8...68.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    70441312a820a461c723a69b991befae918d74843c348aabd7a25899e0c31568

  • Size

    156KB

  • Sample

    220701-drg81ahgaq

  • MD5

    3086fd608ff06991a94b3f7ed891f4ef

  • SHA1

    69112497cd3a29c87a5d5a657aa51f63ef34ce2c

  • SHA256

    70441312a820a461c723a69b991befae918d74843c348aabd7a25899e0c31568

  • SHA512

    b810802141018bf4c970e6b747097f103ba6b7a7f4eaaa305d7d6c5f56e556fa18e8e3edbccfeb140f5250971dd7942b31a18c6ce06d7ead906d4fa2a4179521

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

79.172.242.85:1406

Attributes
  • activex_autorun

    false

  • copy_executable

    true

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • install_path

    %AppData%\Install\Host.exe

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    gqllpDVm

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    true

Targets

    • Target

      70441312a820a461c723a69b991befae918d74843c348aabd7a25899e0c31568

    • Size

      156KB

    • MD5

      3086fd608ff06991a94b3f7ed891f4ef

    • SHA1

      69112497cd3a29c87a5d5a657aa51f63ef34ce2c

    • SHA256

      70441312a820a461c723a69b991befae918d74843c348aabd7a25899e0c31568

    • SHA512

      b810802141018bf4c970e6b747097f103ba6b7a7f4eaaa305d7d6c5f56e556fa18e8e3edbccfeb140f5250971dd7942b31a18c6ce06d7ead906d4fa2a4179521

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks