Overview

overview

10

Static

static

42730c706e...58.exe

windows7_x64

8

42730c706e...58.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    42730c706efc5db3d9243ef8324352254b7d71fb1b2ee05273515e3afc887858

  • Size

    321KB

  • Sample

    220708-cy9q6afgb8

  • MD5

    a4ab019f8082b8f80b35ce6ca6887c69

  • SHA1

    49a37cefa0ce0bfc3b912c65f6da6a35f64c0a46

  • SHA256

    42730c706efc5db3d9243ef8324352254b7d71fb1b2ee05273515e3afc887858

  • SHA512

    a563b3a60ce8727c12c45d2b51445d246774925797ad742c6d432ae7f4eb82659fa8752546ec77ddd9137ed5de049cc3cf89651acd38b8637285a05b9ebed8dd

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      42730c706efc5db3d9243ef8324352254b7d71fb1b2ee05273515e3afc887858

    • Size

      321KB

    • MD5

      a4ab019f8082b8f80b35ce6ca6887c69

    • SHA1

      49a37cefa0ce0bfc3b912c65f6da6a35f64c0a46

    • SHA256

      42730c706efc5db3d9243ef8324352254b7d71fb1b2ee05273515e3afc887858

    • SHA512

      a563b3a60ce8727c12c45d2b51445d246774925797ad742c6d432ae7f4eb82659fa8752546ec77ddd9137ed5de049cc3cf89651acd38b8637285a05b9ebed8dd

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks