Overview

overview

10

Static

static

d0e9b28470...10.exe

windows7-x64

10

d0e9b28470...10.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10

  • Size

    665KB

  • Sample

    221013-bskdmsaccn

  • MD5

    e604dde86770970ad78d95b1ade0c331

  • SHA1

    6359fb645f225302af32574659df56638c9b281f

  • SHA256

    d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10

  • SHA512

    dec6dd01f853195f9262c8a9d6a86b7ded784f3e38f9a51338b93716d39f4f37d45ae6c056e0668a20b0254ed5bb7feb70a7cedf491de7f7aea8991f6de97eee

  • SSDEEP

    12288:P/ctFu3XDG2bv6NpVzJtqM8rp5cKcPONzs13IdqNQhPUM4zG:P/cEG2zOpVNtqM8UKcWNz+Zz

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

212.193.30.230:3363

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Password@2

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10

    • Size

      665KB

    • MD5

      e604dde86770970ad78d95b1ade0c331

    • SHA1

      6359fb645f225302af32574659df56638c9b281f

    • SHA256

      d0e9b284706704c2c36faae86ec33f45cce7ba84cf4d423117c1fd84413e5f10

    • SHA512

      dec6dd01f853195f9262c8a9d6a86b7ded784f3e38f9a51338b93716d39f4f37d45ae6c056e0668a20b0254ed5bb7feb70a7cedf491de7f7aea8991f6de97eee

    • SSDEEP

      12288:P/ctFu3XDG2bv6NpVzJtqM8rp5cKcPONzs13IdqNQhPUM4zG:P/cEG2zOpVNtqM8UKcWNz+Zz

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks