netwire | 345049ac125439890dfd44dc7451de56bcbdebb18230f0facf1858574ffa6c9f | Triage

Submit
Reports

Overview

overview

Static

static

345049ac12...9f.exe

windows7-x64

345049ac12...9f.exe

windows10-2004-x64

Sharing

General

Target

345049ac125439890dfd44dc7451de56bcbdebb18230f0facf1858574ffa6c9f
Size

334KB
Sample

220725-fmy23afggl
MD5

d6e7b054d5d6fe1a95bc2ffe79cec555
SHA1

becb9f6c35b5e3028cf601b1af77630cb8f94005
SHA256

345049ac125439890dfd44dc7451de56bcbdebb18230f0facf1858574ffa6c9f
SHA512

a63a7ab033fdf7faa196ab652c304ab3c2fa47215e800aa46282b2623ba87c4aac58f8478e06d14d77e693c37015c2b2a3a2502dec67d35f4bc6af668477a5af

Score

10^/10

netwire botnet persistence rat stealer

Static task

static1

Behavioral task

behavioral1

Sample

345049ac125439890dfd44dc7451de56bcbdebb18230f0facf1858574ffa6c9f.exe

Resource

win7-20220718-en

netwire botnet persistence rat stealer

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

345049ac125439890dfd44dc7451de56bcbdebb18230f0facf1858574ffa6c9f.exe

Resource

win10v2004-20220721-en

netwire botnet rat stealer

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  345049ac125439890dfd44dc7451de56bcbdebb18230f0facf1858574ffa6c9f
- Size
  
  334KB
- MD5
  
  d6e7b054d5d6fe1a95bc2ffe79cec555
- SHA1
  
  becb9f6c35b5e3028cf601b1af77630cb8f94005
- SHA256
  
  345049ac125439890dfd44dc7451de56bcbdebb18230f0facf1858574ffa6c9f
- SHA512
  
  a63a7ab033fdf7faa196ab652c304ab3c2fa47215e800aa46282b2623ba87c4aac58f8478e06d14d77e693c37015c2b2a3a2502dec67d35f4bc6af668477a5af
Score

10^/10

netwire botnet persistence rat stealer
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

netwirebotnetpersistenceratstealer

behavioral2

netwirebotnetratstealer

© 2018-2024

Terms | Privacy