General
-
Target
dbe65375184221d89d3983a4502e02e7.exe
-
Size
1.4MB
-
Sample
220913-hvd3zafaa6
-
MD5
dbe65375184221d89d3983a4502e02e7
-
SHA1
4e52d5d3f90588c948947ca6f52923df78b08e03
-
SHA256
51d5a73c72f75f984194346b8a9e77fad48059295de86f339c9a092b0d51c9ab
-
SHA512
4d2ef3317e1b49d469af1751dded625d7961931c98b853e22c6c4e6e33165b7522eac37960896cd7814b0b5df1ae4ffc567017bd52022d639a62e72a09234d62
-
SSDEEP
24576:OAOcZyFjJrDqL1P9PO/2QXDKt19YhvrpxAD4b4kImp/AwL:0Dr+LjFQTKFkbADWjAM
Static task
static1
Behavioral task
behavioral1
Sample
dbe65375184221d89d3983a4502e02e7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dbe65375184221d89d3983a4502e02e7.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
netwire
212.193.30.230:3363
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password@2
-
registry_autorun
false
-
use_mutex
false
Targets
-
-
Target
dbe65375184221d89d3983a4502e02e7.exe
-
Size
1.4MB
-
MD5
dbe65375184221d89d3983a4502e02e7
-
SHA1
4e52d5d3f90588c948947ca6f52923df78b08e03
-
SHA256
51d5a73c72f75f984194346b8a9e77fad48059295de86f339c9a092b0d51c9ab
-
SHA512
4d2ef3317e1b49d469af1751dded625d7961931c98b853e22c6c4e6e33165b7522eac37960896cd7814b0b5df1ae4ffc567017bd52022d639a62e72a09234d62
-
SSDEEP
24576:OAOcZyFjJrDqL1P9PO/2QXDKt19YhvrpxAD4b4kImp/AwL:0Dr+LjFQTKFkbADWjAM
Score10/10-
NetWire RAT payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-