Extracted

• • Target

    TAX INVOICE 00893.xlsm

  • Size

    42KB

  • MD5

    dfd371ebf737c86675d54224482f3bf3

  • SHA1

    e84195e5871bfef86c18563ebe7b6ad1077f81e5

  • SHA256

    e209b1e1be73d201c0cf316df426fa1e0c2b436acf2d8c269ac6694b936d839e

  • SHA512

    994ba3a222532826c82081eb92ecb6d5cd57faf162fbd5e84ec1679fa13def5813b48c0f0b40044adf92a72ea9c6778c66474690635a7d0597e0f7c43b4391f2

  Score

  10^/10

  netwirebotnetratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2