Overview

overview

10

Static

static

SPECIFICAT...ER.exe

windows7_x64

10

SPECIFICAT...ER.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SPECIFICATION AND PURCHASE ORDER.exe

  • Size

    812KB

  • Sample

    220713-d5w93scec2

  • MD5

    d07de9673f83a9d2a8726902a324e9b6

  • SHA1

    757006cbc6e8f1c0d51cb24de633ead08585482f

  • SHA256

    be3dd3aea40216ce3f0a8427cef56e288bbbea5718983905adbc827dd79b3d80

  • SHA512

    b56c6062d9817cfe783839a256f713a56be1968974f82ab25062d4bb0cbf2ab8201058bd96c4c66fc26def7b702d4d82b882154412e13dfd78c6c818d6b067da

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

37.0.14.203:3083

Attributes
  • activex_autorun

    false

  • copy_executable

    true

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • install_path

    %AppData%\Install\Host.exe

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Elibee88

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      SPECIFICATION AND PURCHASE ORDER.exe

    • Size

      812KB

    • MD5

      d07de9673f83a9d2a8726902a324e9b6

    • SHA1

      757006cbc6e8f1c0d51cb24de633ead08585482f

    • SHA256

      be3dd3aea40216ce3f0a8427cef56e288bbbea5718983905adbc827dd79b3d80

    • SHA512

      b56c6062d9817cfe783839a256f713a56be1968974f82ab25062d4bb0cbf2ab8201058bd96c4c66fc26def7b702d4d82b882154412e13dfd78c6c818d6b067da

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks