Overview

overview

10

Static

static

221dad5e31...b9.exe

windows7-x64

10

221dad5e31...b9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    221dad5e31cb4eb08c988678f1f87d01dba59dcd8b50f2aa44251886689473b9

  • Size

    136KB

  • Sample

    221120-mhax1acg71

  • MD5

    06cf9a05d777a08ecc04c8502fbbac30

  • SHA1

    ba53dd1b24d82e372ca2ce198d13011795d15587

  • SHA256

    221dad5e31cb4eb08c988678f1f87d01dba59dcd8b50f2aa44251886689473b9

  • SHA512

    4152b61e4688f9cffef6f01e4a420f630d93f900ea7131682c5ceadfbfc3bc363953e010925ccfa5c5a96ab50b3fc8bc9c54b981c2e6cfa8ebc242773cd2d013

  • SSDEEP

    3072:tq/+4f56wDQlPGWm5vGIdupbixJobw5NIZ66LQ:tq//QlPGWAeIdupmxJoF66L

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      221dad5e31cb4eb08c988678f1f87d01dba59dcd8b50f2aa44251886689473b9

    • Size

      136KB

    • MD5

      06cf9a05d777a08ecc04c8502fbbac30

    • SHA1

      ba53dd1b24d82e372ca2ce198d13011795d15587

    • SHA256

      221dad5e31cb4eb08c988678f1f87d01dba59dcd8b50f2aa44251886689473b9

    • SHA512

      4152b61e4688f9cffef6f01e4a420f630d93f900ea7131682c5ceadfbfc3bc363953e010925ccfa5c5a96ab50b3fc8bc9c54b981c2e6cfa8ebc242773cd2d013

    • SSDEEP

      3072:tq/+4f56wDQlPGWm5vGIdupbixJobw5NIZ66LQ:tq//QlPGWAeIdupmxJoF66L

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks