Overview

overview

10

Static

static

f8e24a7edb...ec.exe

windows7_x64

10

f8e24a7edb...ec.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f8e24a7edb17483766f3aadfc53026fac205c569b11da4efb4d3e170d09f83ec

  • Size

    720KB

  • Sample

    220701-es5alabegj

  • MD5

    8a2d74da2cb517018fb37b0a790cacb4

  • SHA1

    14f283f4993c03f1ea62ae56f479fb35a99a1a0b

  • SHA256

    f8e24a7edb17483766f3aadfc53026fac205c569b11da4efb4d3e170d09f83ec

  • SHA512

    cb7b691718a89db98cecff4d2ee41dee07d10428cf9bb0baa1b218c6cf9cc5d09b003d05558526d9c926e8ba8b04c0fe7563e626f860a635454818962a32859f

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      f8e24a7edb17483766f3aadfc53026fac205c569b11da4efb4d3e170d09f83ec

    • Size

      720KB

    • MD5

      8a2d74da2cb517018fb37b0a790cacb4

    • SHA1

      14f283f4993c03f1ea62ae56f479fb35a99a1a0b

    • SHA256

      f8e24a7edb17483766f3aadfc53026fac205c569b11da4efb4d3e170d09f83ec

    • SHA512

      cb7b691718a89db98cecff4d2ee41dee07d10428cf9bb0baa1b218c6cf9cc5d09b003d05558526d9c926e8ba8b04c0fe7563e626f860a635454818962a32859f

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks