Overview

overview

10

Static

static

FACTURA-02...87.exe

windows7-x64

10

FACTURA-02...87.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e925c310f6d769fdb081f2ba93121193

  • Size

    1.2MB

  • Sample

    220804-1bngeacbhl

  • MD5

    e925c310f6d769fdb081f2ba93121193

  • SHA1

    8b9a281515cfb794a3f8655e09a2e4c0bac27532

  • SHA256

    85755fdd7d66bda13db7de7e926464957f51837ce93dd9951da3774c8b469f38

  • SHA512

    6da1a84c8090ecaf0848e7424c6e30ade7d3ec7358cc0693c8c312418571ec51ece43d1a6a9ac6d647bcedd6e8b92e798660b0f5b66c501136f604f658908102

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

xman2.duckdns.org:4433

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      FACTURA-027783278873287.exe

    • Size

      1.3MB

    • MD5

      35711d2a8e8e96e025f54b5ca77db5f5

    • SHA1

      4e3776b5db886079b003c28bec7656c5882d6fd0

    • SHA256

      00c21d0a93a75ed3a206befabace5574014f5ea5dfbd314e46e3720d82c7a2e6

    • SHA512

      917e3d4bf94133828375d69cfa21557405452fa28ddf5d874635867526eb670b4308815a81124d6ebdb5640c1890c48f22d4ee46ec0180af3310241dfbfcc862

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks