General

  • Target

    4704de87ef010ac7a8d04e2e650e53527d4b924c4e3900f98edbc16dbd0f75c2

  • Size

    619KB

  • Sample

    220701-e2xl4scabq

  • MD5

    664ecb6af2af6469eb9b244db34449ff

  • SHA1

    f950ee4efd8919142d1ac3af81e18cba1db9add6

  • SHA256

    4704de87ef010ac7a8d04e2e650e53527d4b924c4e3900f98edbc16dbd0f75c2

  • SHA512

    ed4a8dc0913bb9b3983c76ae87b7670016dd0e54f00f12ca4e77e90aaf7c5704877132a46a912521f1243e0a6f3cf83e541032874e1a449de6a5a331bec784a9

Malware Config

Targets

    • Target

      4704de87ef010ac7a8d04e2e650e53527d4b924c4e3900f98edbc16dbd0f75c2

    • Size

      619KB

    • MD5

      664ecb6af2af6469eb9b244db34449ff

    • SHA1

      f950ee4efd8919142d1ac3af81e18cba1db9add6

    • SHA256

      4704de87ef010ac7a8d04e2e650e53527d4b924c4e3900f98edbc16dbd0f75c2

    • SHA512

      ed4a8dc0913bb9b3983c76ae87b7670016dd0e54f00f12ca4e77e90aaf7c5704877132a46a912521f1243e0a6f3cf83e541032874e1a449de6a5a331bec784a9

    • NetWire RAT payload

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks