Overview

overview

10

Static

static

ec5e55827e...15.exe

windows7-x64

10

ec5e55827e...15.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ec5e55827edf95d098ae5d7731cfa6c2e43c12ff2967dba25b291c194226e815

  • Size

    99KB

  • Sample

    221021-x3djqsbhg3

  • MD5

    205819e715877fa9f0c28f80f313b360

  • SHA1

    b2172b04ff7cf85dee45218106f354d10e100cc9

  • SHA256

    ec5e55827edf95d098ae5d7731cfa6c2e43c12ff2967dba25b291c194226e815

  • SHA512

    87be48b3f252333c81768071eb5ed833606acd7b23dc730c810e41ad44fef8a0f00c5784acda6958c66bd6bd16a9acb355f1d15ae1400c835b68a288e3169a4c

  • SSDEEP

    3072:ulwT11JOsyobBuL7OdhR5rgGuXMQ8oWfz16xO:UwxdbBuLSdlwWoWh6xO

Score
10/10
netwirebotnetevasionpersistenceratstealer

Malware Config

Targets

    • Target

      ec5e55827edf95d098ae5d7731cfa6c2e43c12ff2967dba25b291c194226e815

    • Size

      99KB

    • MD5

      205819e715877fa9f0c28f80f313b360

    • SHA1

      b2172b04ff7cf85dee45218106f354d10e100cc9

    • SHA256

      ec5e55827edf95d098ae5d7731cfa6c2e43c12ff2967dba25b291c194226e815

    • SHA512

      87be48b3f252333c81768071eb5ed833606acd7b23dc730c810e41ad44fef8a0f00c5784acda6958c66bd6bd16a9acb355f1d15ae1400c835b68a288e3169a4c

    • SSDEEP

      3072:ulwT11JOsyobBuL7OdhR5rgGuXMQ8oWfz16xO:UwxdbBuLSdlwWoWh6xO

    Score
    10/10
    netwirebotnetevasionpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2
T1158

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks