Overview

overview

10

Static

static

wDNJC.exe

windows7-x64

10

wDNJC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    47b2929ffb1448876e74dd33b3124268

  • Size

    815KB

  • Sample

    220830-xkdrsafdd7

  • MD5

    47b2929ffb1448876e74dd33b3124268

  • SHA1

    05c30803ff2d284c163451aeab58c916ba0b4d2b

  • SHA256

    d5e1e80805fe634c32394e803320947ae9b41803319026e37df9cca8a144b79b

  • SHA512

    0ae191400f435e2bc86caf8831b57859e26329abf2f5625ae9e440295c5b6fda54c20e21f56ee14855e2709532139d6ef0761bdab74a56cd91f4d7b81752e01e

  • SSDEEP

    24576:p6unwNxTJ231+IJelz8fCQZGT57gBejum:XwrkCSZGx

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

gds099.mooo.com:5550

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • install_path

    %AppData%\Install\MShost.exe

  • keylogger_dir

    MShost.lnk

  • lock_executable

    false

  • mutex

    OtuMUNDs

  • offline_keylogger

    false

  • password

    Zaq1Xsw2**

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      wDNJC.exe

    • Size

      2.0MB

    • MD5

      f5ec17c60ef0f6a7e8ea953620e29a5e

    • SHA1

      3716d78a63e864c34990e6bc5804b546a36d3b42

    • SHA256

      0209bfb47ca535457658702f73c8ab4333b72dfaa0c6e8a8a6a65d438337d056

    • SHA512

      53ba94c47260c9ed00b96d2de762c4e1b735e504125b0ae1dd64f3542cc10cae48a42571abdef8b774f673840cd052ff1802a83f5309a851f66453652fb7fb10

    • SSDEEP

      24576:5vGRX9MVXJKVg6E+HLvZ8ZMk9hZYm8jASuhnczQtqmA22IO:oXwV6LB4him80j9c8QmQ

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks