General

  • Target

    SecuriteInfo.com.Trojan.Siggen18.52433.24924.20991.exe

  • Size

    742KB

  • Sample

    220929-c9wcxaheh8

  • MD5

    cecd0e8e9b43caa70606fcb5a6193a76

  • SHA1

    b7b3fa7b44446644a3a7f7b89852e8fde90c73b3

  • SHA256

    1b1d355eb5f82bf03c063948005173e8dcb3d5051c7dc047dadbd471eca9cc87

  • SHA512

    d0c184c8962ce3a4aa175088d3ef926ed086be7d557f6fc8d8cab0d7f02d801979f2c36c90b8edfce00bd8553552195e6a00390227d62f1ea67ac4aabd319ac5

Malware Config

Extracted

Family

netwire

C2

139.28.38.235:6080

Attributes
activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-coCuwk
lock_executable
true
mutex
idkKpqiV
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
true

Targets

    • Target

      SecuriteInfo.com.Trojan.Siggen18.52433.24924.20991.exe

    • Size

      742KB

    • MD5

      cecd0e8e9b43caa70606fcb5a6193a76

    • SHA1

      b7b3fa7b44446644a3a7f7b89852e8fde90c73b3

    • SHA256

      1b1d355eb5f82bf03c063948005173e8dcb3d5051c7dc047dadbd471eca9cc87

    • SHA512

      d0c184c8962ce3a4aa175088d3ef926ed086be7d557f6fc8d8cab0d7f02d801979f2c36c90b8edfce00bd8553552195e6a00390227d62f1ea67ac4aabd319ac5

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • NetWire RAT payload

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation