netwire | 670a2c1b9bd9340f63a0e13278a45cb590a178a4b717bcf23770fca272b6c741 | Triage

Submit
Reports

Overview

overview

Static

static

670a2c1b9b...41.exe

windows7-x64

670a2c1b9b...41.exe

windows10-2004-x64

Sharing

General

Target

670a2c1b9bd9340f63a0e13278a45cb590a178a4b717bcf23770fca272b6c741
Size

140KB
Sample

221019-2mj4ssbeg3
MD5

82af750f8f9bf4aa423f22c1d1b5b6f0
SHA1

17e9cf1584526d086b38bfbcb327a67ea4e62bd1
SHA256

670a2c1b9bd9340f63a0e13278a45cb590a178a4b717bcf23770fca272b6c741
SHA512

b6a2313766eba97b4da2ae8869e24a6a696d8dd59a46b772cdf1009e69e81ef0eb6efac352ce0951dc07f9e07867cb79a41df8cd2a2a4e749ff1752a5d1c0a42
SSDEEP

3072:SKQT3Slg2wZ8NZaiUwXTe2KHE+91oxaAu/Xiw7uQkXU:gDF83/Te2DbSiwqQGU

Score

10^/10

netwire botnet persistence rat stealer

Static task

static1

Behavioral task

behavioral1

Sample

670a2c1b9bd9340f63a0e13278a45cb590a178a4b717bcf23770fca272b6c741.exe

Resource

win7-20220812-en

netwire botnet persistence rat stealer

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

670a2c1b9bd9340f63a0e13278a45cb590a178a4b717bcf23770fca272b6c741.exe

Resource

win10v2004-20220812-en

netwire botnet persistence rat stealer

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  670a2c1b9bd9340f63a0e13278a45cb590a178a4b717bcf23770fca272b6c741
- Size
  
  140KB
- MD5
  
  82af750f8f9bf4aa423f22c1d1b5b6f0
- SHA1
  
  17e9cf1584526d086b38bfbcb327a67ea4e62bd1
- SHA256
  
  670a2c1b9bd9340f63a0e13278a45cb590a178a4b717bcf23770fca272b6c741
- SHA512
  
  b6a2313766eba97b4da2ae8869e24a6a696d8dd59a46b772cdf1009e69e81ef0eb6efac352ce0951dc07f9e07867cb79a41df8cd2a2a4e749ff1752a5d1c0a42
- SSDEEP
  
  3072:SKQT3Slg2wZ8NZaiUwXTe2KHE+91oxaAu/Xiw7uQkXU:gDF83/Te2DbSiwqQGU
Score

10^/10

netwire botnet persistence rat stealer
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

netwirebotnetpersistenceratstealer

behavioral2

netwirebotnetpersistenceratstealer

© 2018-2024

Terms | Privacy