netwire | c1c7442a04c7192adf200d9aa31c08c435177c3260563c694e4dc27329619ffe | Triage

Submit
Reports

Overview

overview

Static

static

c1c7442a04...fe.exe

windows7-x64

c1c7442a04...fe.exe

windows10-2004-x64

Sharing

General

Target

c1c7442a04c7192adf200d9aa31c08c435177c3260563c694e4dc27329619ffe
Size

561KB
Sample

220724-2l11xsbdgr
MD5

0ab8b9c1bba35c18c6dc2bb3f0970318
SHA1

145317e69240fbd896a381f7bda6d8d5c7af51aa
SHA256

c1c7442a04c7192adf200d9aa31c08c435177c3260563c694e4dc27329619ffe
SHA512

acfd97134038e35f601efc53dc922cabb9def28dea50b090c493db8b4b826793d363f47e349008da8ea0fd515a4bd8495c52c22cdb281cc8987b318a131cda59

Score

10^/10

netwire botnet rat stealer

Static task

static1

Behavioral task

behavioral1

Sample

c1c7442a04c7192adf200d9aa31c08c435177c3260563c694e4dc27329619ffe.exe

Resource

win7-20220715-en

netwire botnet rat stealer

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

c1c7442a04c7192adf200d9aa31c08c435177c3260563c694e4dc27329619ffe.exe

Resource

win10v2004-20220721-en

netwire botnet rat stealer

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  c1c7442a04c7192adf200d9aa31c08c435177c3260563c694e4dc27329619ffe
- Size
  
  561KB
- MD5
  
  0ab8b9c1bba35c18c6dc2bb3f0970318
- SHA1
  
  145317e69240fbd896a381f7bda6d8d5c7af51aa
- SHA256
  
  c1c7442a04c7192adf200d9aa31c08c435177c3260563c694e4dc27329619ffe
- SHA512
  
  acfd97134038e35f601efc53dc922cabb9def28dea50b090c493db8b4b826793d363f47e349008da8ea0fd515a4bd8495c52c22cdb281cc8987b318a131cda59
Score

10^/10

netwire botnet rat stealer
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

netwirebotnetratstealer

behavioral2

netwirebotnetratstealer

© 2018-2024

Terms | Privacy