Overview

overview

10

Static

static

1

49e1a16ee8...8e.exe

windows7_x64

10

49e1a16ee8...8e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    49e1a16ee8c68203aeb1870e7f73a1ad83434ef95afafe654e08dde6e687cc8e

  • Size

    143KB

  • Sample

    220712-sqeh2sadh2

  • MD5

    4181762593fe73ba01f1797126a857ee

  • SHA1

    d7e2fd23ebbcd151a56de54ea8b47c47b419b07e

  • SHA256

    49e1a16ee8c68203aeb1870e7f73a1ad83434ef95afafe654e08dde6e687cc8e

  • SHA512

    b66a0fc4fe35c624b09ba17e79c64ac2ca603dae270ea1c70a13e59d865ed3f4e535f27ea40653a9fe12a20ff9e86a270994d597f7cdb4460547b224c820017d

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      49e1a16ee8c68203aeb1870e7f73a1ad83434ef95afafe654e08dde6e687cc8e

    • Size

      143KB

    • MD5

      4181762593fe73ba01f1797126a857ee

    • SHA1

      d7e2fd23ebbcd151a56de54ea8b47c47b419b07e

    • SHA256

      49e1a16ee8c68203aeb1870e7f73a1ad83434ef95afafe654e08dde6e687cc8e

    • SHA512

      b66a0fc4fe35c624b09ba17e79c64ac2ca603dae270ea1c70a13e59d865ed3f4e535f27ea40653a9fe12a20ff9e86a270994d597f7cdb4460547b224c820017d

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks