General
-
Target
843df60aa9f4b6f813a09b53f790d0ab1305de254e6df30ca012139ed785b367
-
Size
835KB
-
Sample
220701-fgqthacgcp
-
MD5
c6d4958ce665a49122d2978072be77a6
-
SHA1
07851b16d1a7f44bf1c8eb182525b895ac5b9273
-
SHA256
843df60aa9f4b6f813a09b53f790d0ab1305de254e6df30ca012139ed785b367
-
SHA512
01795bcc64e411b8b35e2c21b3113cd0d69c79eac635fdf70899a19f85f8ae79a22f3566a45c9d7a1af9f35bf539abc478ed591ae944982b6969f8755eb2d048
Static task
static1
Behavioral task
behavioral1
Sample
843df60aa9f4b6f813a09b53f790d0ab1305de254e6df30ca012139ed785b367.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
843df60aa9f4b6f813a09b53f790d0ab1305de254e6df30ca012139ed785b367.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
netwire
5.133.15.5:3389
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
MayPro123
-
registry_autorun
false
-
use_mutex
false
Targets
-
-
Target
843df60aa9f4b6f813a09b53f790d0ab1305de254e6df30ca012139ed785b367
-
Size
835KB
-
MD5
c6d4958ce665a49122d2978072be77a6
-
SHA1
07851b16d1a7f44bf1c8eb182525b895ac5b9273
-
SHA256
843df60aa9f4b6f813a09b53f790d0ab1305de254e6df30ca012139ed785b367
-
SHA512
01795bcc64e411b8b35e2c21b3113cd0d69c79eac635fdf70899a19f85f8ae79a22f3566a45c9d7a1af9f35bf539abc478ed591ae944982b6969f8755eb2d048
Score10/10-
NetWire RAT payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-