Overview

overview

10

Static

static

682e7f4053...91.rtf

windows7-x64

10

682e7f4053...91.rtf

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    682e7f4053a133c8fe08dfede3962d5af96f01dff69a72ac0b0f0ba8afc57191

  • Size

    1.2MB

  • Sample

    221003-cfr4dsdahk

  • MD5

    6e752a28a3d4f61fb158099beab88f90

  • SHA1

    d8c18216e718401d37a81674d4f4bb95f16742c6

  • SHA256

    682e7f4053a133c8fe08dfede3962d5af96f01dff69a72ac0b0f0ba8afc57191

  • SHA512

    66bad4bab339a255cded95b6a03df4c149c486deceb23c3fd55080b16d48251bc7ad4db5e5e74c95ad46deebbdbb70fa05ee6fa26ae01e56fa9a89d9ad32e1eb

  • SSDEEP

    24576:ko+0Kiy8TOWMRIHjVK+v8GhCXjyx5VqJKnMbYbor+CzzGxp:x

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      682e7f4053a133c8fe08dfede3962d5af96f01dff69a72ac0b0f0ba8afc57191

    • Size

      1.2MB

    • MD5

      6e752a28a3d4f61fb158099beab88f90

    • SHA1

      d8c18216e718401d37a81674d4f4bb95f16742c6

    • SHA256

      682e7f4053a133c8fe08dfede3962d5af96f01dff69a72ac0b0f0ba8afc57191

    • SHA512

      66bad4bab339a255cded95b6a03df4c149c486deceb23c3fd55080b16d48251bc7ad4db5e5e74c95ad46deebbdbb70fa05ee6fa26ae01e56fa9a89d9ad32e1eb

    • SSDEEP

      24576:ko+0Kiy8TOWMRIHjVK+v8GhCXjyx5VqJKnMbYbor+CzzGxp:x

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks