netwire | a142716c38a65f2d71e8f1bea1c6f7f0b49f631d92ff70d719ca93cc11372b7f | Triage

Submit
Reports

Overview

overview

Static

static

a142716c38...7f.exe

windows7-x64

a142716c38...7f.exe

windows10-2004-x64

Sharing

General

Target

a142716c38a65f2d71e8f1bea1c6f7f0b49f631d92ff70d719ca93cc11372b7f
Size

219KB
Sample

221001-zajw6aedc6
MD5

69fe47844312a1dd8a8a4b64eace8bb0
SHA1

1080345aa844d9e0202aeb15f8299a961b35adad
SHA256

a142716c38a65f2d71e8f1bea1c6f7f0b49f631d92ff70d719ca93cc11372b7f
SHA512

d0409b6f448772ab97ce6395dd96a9490a13db8e5a14a642b5b28e184a5ada9b82c0f1142a6290c501b67adef8f8681142f5c49d32de6e48b06e1647f125c12d
SSDEEP

6144:PkHrBxmJv65Us2rv7QtHQy71FxVVh/UF/gk5c:sdMJeUs2z7uHQSzzn/UNgk5c

Score

10^/10

netwire botnet persistence rat stealer

Static task

static1

Behavioral task

behavioral1

Sample

a142716c38a65f2d71e8f1bea1c6f7f0b49f631d92ff70d719ca93cc11372b7f.exe

Resource

win7-20220812-en

netwire botnet persistence rat stealer

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

a142716c38a65f2d71e8f1bea1c6f7f0b49f631d92ff70d719ca93cc11372b7f.exe

Resource

win10v2004-20220812-en

netwire botnet persistence rat stealer

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  a142716c38a65f2d71e8f1bea1c6f7f0b49f631d92ff70d719ca93cc11372b7f
- Size
  
  219KB
- MD5
  
  69fe47844312a1dd8a8a4b64eace8bb0
- SHA1
  
  1080345aa844d9e0202aeb15f8299a961b35adad
- SHA256
  
  a142716c38a65f2d71e8f1bea1c6f7f0b49f631d92ff70d719ca93cc11372b7f
- SHA512
  
  d0409b6f448772ab97ce6395dd96a9490a13db8e5a14a642b5b28e184a5ada9b82c0f1142a6290c501b67adef8f8681142f5c49d32de6e48b06e1647f125c12d
- SSDEEP
  
  6144:PkHrBxmJv65Us2rv7QtHQy71FxVVh/UF/gk5c:sdMJeUs2z7uHQSzzn/UNgk5c
Score

10^/10

netwire botnet persistence rat stealer
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

netwirebotnetpersistenceratstealer

behavioral2

netwirebotnetpersistenceratstealer

© 2018-2024

Terms | Privacy