General

  • Target

    46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107

  • Size

    99KB

  • Sample

    221013-wbdvrafee4

  • MD5

    68bb2bc04c3e1e1c2d88aa6f73285bb0

  • SHA1

    dc00c4fb8e14e11395935b215c86c88e3e72e0eb

  • SHA256

    46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107

  • SHA512

    f610028ac9d39912d62e8dc8e26f9bbe13f061066561999cb40e0b61362bfc249f35829dacb8d4cb12b1622ed729a4afbc7f73f2595d76da65f4e65807c5a276

  • SSDEEP

    3072:elwT11JOsyobBuL7OdhR5rgGuXMQ8oWfz16xK:EwxdbBuLSdlwWoWh6xK

Malware Config

Targets

    • Target

      46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107

    • Size

      99KB

    • MD5

      68bb2bc04c3e1e1c2d88aa6f73285bb0

    • SHA1

      dc00c4fb8e14e11395935b215c86c88e3e72e0eb

    • SHA256

      46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107

    • SHA512

      f610028ac9d39912d62e8dc8e26f9bbe13f061066561999cb40e0b61362bfc249f35829dacb8d4cb12b1622ed729a4afbc7f73f2595d76da65f4e65807c5a276

    • SSDEEP

      3072:elwT11JOsyobBuL7OdhR5rgGuXMQ8oWfz16xK:EwxdbBuLSdlwWoWh6xK

    • NetWire RAT payload

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Hidden Files and Directories

2
T1158

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Tasks