Overview

overview

10

Static

static

dbb7bd6fcc...a9.exe

windows7-x64

10

dbb7bd6fcc...a9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dbb7bd6fcc8d6536b345ad60b9a73f6347a7a3cdeeb6d70c30e3cc071bc385a9

  • Size

    929KB

  • Sample

    221029-qkcq6ahfdj

  • MD5

    9b9168993c6917e4d22c803e5debae72

  • SHA1

    8246cc5731773b5dd5b4cad5e4c9d647af5e6ab6

  • SHA256

    dbb7bd6fcc8d6536b345ad60b9a73f6347a7a3cdeeb6d70c30e3cc071bc385a9

  • SHA512

    27e1761af2a901da6f05220dbd9f3c77e85b53a48f5f23bcf1e59dc0a45b57f6f30fee89e96632f27c4a96c02e0f78ae04564f4ebd839103484b99dfd7281051

  • SSDEEP

    12288:SK2mhAMJ/cPly0xW2/Npj8h7UZYE82Y5UKUL4n4y3Xp3SbSlQMYs:T2O/GlyEW2j47g6zwm4m53Sb21Ys

Score
10/10
netwirebotnetevasionpersistenceratstealertrojan

Malware Config

Targets

    • Target

      dbb7bd6fcc8d6536b345ad60b9a73f6347a7a3cdeeb6d70c30e3cc071bc385a9

    • Size

      929KB

    • MD5

      9b9168993c6917e4d22c803e5debae72

    • SHA1

      8246cc5731773b5dd5b4cad5e4c9d647af5e6ab6

    • SHA256

      dbb7bd6fcc8d6536b345ad60b9a73f6347a7a3cdeeb6d70c30e3cc071bc385a9

    • SHA512

      27e1761af2a901da6f05220dbd9f3c77e85b53a48f5f23bcf1e59dc0a45b57f6f30fee89e96632f27c4a96c02e0f78ae04564f4ebd839103484b99dfd7281051

    • SSDEEP

      12288:SK2mhAMJ/cPly0xW2/Npj8h7UZYE82Y5UKUL4n4y3Xp3SbSlQMYs:T2O/GlyEW2j47g6zwm4m53Sb21Ys

    Score
    10/10
    netwirebotnetevasionpersistenceratstealertrojan

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks