netwire

General

Target

56dce82fbb50a596c617d96dbc093df4dc0e706743dcb5014bff4e05b067f9c1
Size

2.3MB
Sample

220725-bvfs8shcfl
MD5

769b53a20169c402f96c41264e63d993
SHA1

234efdc38581283b433b9ae93acad8ca0adbb38b
SHA256

56dce82fbb50a596c617d96dbc093df4dc0e706743dcb5014bff4e05b067f9c1
SHA512

130668eb4eb2f74088176a0dfaad0b7a23a2b7fec5d333a7c919b2e062778c8e95f84dc7c4b7bd3ad9dee2e2e2af4392617f8bdb0068b43e9bc8444745c4d9ca

Score

10^/10

Malware Config

Extracted

Family

netwire

C2

bedahogs.100chickens.me:6065

Attributes

activex_autorun
true
activex_key
{5M67M2F2-36J1-VF8Q-82EI-SXNC4S0578Q0}
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\MSC.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
dNigsAJo
offline_keylogger
true
password
Password
registry_autorun
true
startup_name
Settings
use_mutex
true

Targets

- Target
  
  56dce82fbb50a596c617d96dbc093df4dc0e706743dcb5014bff4e05b067f9c1
- Size
  
  2.3MB
- MD5
  
  769b53a20169c402f96c41264e63d993
- SHA1
  
  234efdc38581283b433b9ae93acad8ca0adbb38b
- SHA256
  
  56dce82fbb50a596c617d96dbc093df4dc0e706743dcb5014bff4e05b067f9c1
- SHA512
  
  130668eb4eb2f74088176a0dfaad0b7a23a2b7fec5d333a7c919b2e062778c8e95f84dc7c4b7bd3ad9dee2e2e2af4392617f8bdb0068b43e9bc8444745c4d9ca
Score

10^/10

netwire botnet persistence rat stealer
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

NetWire RAT payload

Executes dropped EXE

Modifies Installed Components in the registry

Loads dropped DLL

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2