Overview

overview

10

Static

static

2fc97a9025...23.exe

windows7-x64

10

2fc97a9025...23.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    80s
  • max time network
    86s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    13-08-2022 09:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2fc97a9025f097a4c1040c2a50d644ad2979f56e8caf337a1a788297f6be7123.exe

  • Size

    2.0MB

  • MD5

    01028a50efa2f9e058f61a39b2b412c9

  • SHA1

    bc8dcbc889c867fd8be2a3a16d2944107046651f

  • SHA256

    2fc97a9025f097a4c1040c2a50d644ad2979f56e8caf337a1a788297f6be7123

  • SHA512

    efbc5a1f76469dba0ef096c5d297bd8760e59567f4314a611b528f83fe088de389a40137a890179c3976abfb1c4e520e8ef3674d99b2db2d4fe136449a9da4bf

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

septton.com:5389

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-wgyqU8

  • lock_executable

    false

  • mutex

    ObwQvAVd

  • offline_keylogger

    false

  • password

    Password123

  • registry_autorun

    false

  • use_mutex

    true

Signatures

  • NetWire RAT payload 1 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2fc97a9025f097a4c1040c2a50d644ad2979f56e8caf337a1a788297f6be7123.exe
    "C:\Users\Admin\AppData\Local\Temp\2fc97a9025f097a4c1040c2a50d644ad2979f56e8caf337a1a788297f6be7123.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1876-54-0x0000000075481000-0x0000000075483000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1876-55-0x00000000002E0000-0x000000000035B000-memory.dmp
    Filesize

    492KB

    Download
  • memory/1876-56-0x0000000001EC0000-0x0000000002040000-memory.dmp
    Filesize

    1.5MB

    Download
  • memory/1876-57-0x00000000003B0000-0x00000000003E3000-memory.dmp
    Filesize

    204KB

    Download
  • memory/1876-58-0x00000000002E0000-0x000000000035B000-memory.dmp
    Filesize

    492KB

    Download