Overview

overview

10

Static

static

2ada082e83...7b.exe

windows7-x64

10

2ada082e83...7b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2ada082e83bf395790bdfe83564d7bdc711de7b66a3d3615f85d6217701d7c7b

  • Size

    337KB

  • Sample

    221123-r3da3sdc2v

  • MD5

    729d5a1609fe981f93cfdd4f938dbbae

  • SHA1

    6954cdfca61258328b80b670e2099beb8e768ef7

  • SHA256

    2ada082e83bf395790bdfe83564d7bdc711de7b66a3d3615f85d6217701d7c7b

  • SHA512

    56647a30a1739f34ee8364b5636945c3a881a280b045128dc60dbebe6a66ca53231ec1465dba7249a7a04aca64df7df1bc260897a27730cba85d9f3c1f6b8264

  • SSDEEP

    6144:sIm+KvQEgWF18i6a3IkfcU9HRuaNjwyDJ:sdYD5ex8a3

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      2ada082e83bf395790bdfe83564d7bdc711de7b66a3d3615f85d6217701d7c7b

    • Size

      337KB

    • MD5

      729d5a1609fe981f93cfdd4f938dbbae

    • SHA1

      6954cdfca61258328b80b670e2099beb8e768ef7

    • SHA256

      2ada082e83bf395790bdfe83564d7bdc711de7b66a3d3615f85d6217701d7c7b

    • SHA512

      56647a30a1739f34ee8364b5636945c3a881a280b045128dc60dbebe6a66ca53231ec1465dba7249a7a04aca64df7df1bc260897a27730cba85d9f3c1f6b8264

    • SSDEEP

      6144:sIm+KvQEgWF18i6a3IkfcU9HRuaNjwyDJ:sdYD5ex8a3

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks