General
-
Target
5e1f0542636814e96f15f084b740b5d3680bef560625ac4031ec3232de1d145f
-
Size
612KB
-
Sample
220731-z7rm9sghc2
-
MD5
1f08b650f926b37d907490da79ecd09e
-
SHA1
e70b0082ff5dc6e4247b638fc686417e7be0c08e
-
SHA256
5e1f0542636814e96f15f084b740b5d3680bef560625ac4031ec3232de1d145f
-
SHA512
5afc104cd2bc969bc0d1c5b19f08b7ad68dbb30a76e596d188cebb9a2f8aa37f61e7a4f154291c2970b846d80c9b7706513e8405b6a5cbf0300df9c703151bfe
Static task
static1
Behavioral task
behavioral1
Sample
5e1f0542636814e96f15f084b740b5d3680bef560625ac4031ec3232de1d145f.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5e1f0542636814e96f15f084b740b5d3680bef560625ac4031ec3232de1d145f.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
netwire
wow1234.duckdns.org:32144
-
activex_autorun
true
-
activex_key
{57776084-ASLK-C625-238F-335P7L38NO2E}
-
copy_executable
true
-
delete_original
false
-
host_id
wow1234
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
gbam1234
-
registry_autorun
true
-
startup_name
NetWire
-
use_mutex
false
Targets
-
-
Target
5e1f0542636814e96f15f084b740b5d3680bef560625ac4031ec3232de1d145f
-
Size
612KB
-
MD5
1f08b650f926b37d907490da79ecd09e
-
SHA1
e70b0082ff5dc6e4247b638fc686417e7be0c08e
-
SHA256
5e1f0542636814e96f15f084b740b5d3680bef560625ac4031ec3232de1d145f
-
SHA512
5afc104cd2bc969bc0d1c5b19f08b7ad68dbb30a76e596d188cebb9a2f8aa37f61e7a4f154291c2970b846d80c9b7706513e8405b6a5cbf0300df9c703151bfe
Score10/10-
NetWire RAT payload
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-