netwire | bb61e1a70b151c6fd4e4bfd1bcd4048eeb69f4c6ae5df19f2cdb31be982ae8ae | Triage

Submit
Reports

Overview

overview

Static

static

bb61e1a70b...ae.exe

windows7-x64

bb61e1a70b...ae.exe

windows10-2004-x64

Sharing

General

Target

bb61e1a70b151c6fd4e4bfd1bcd4048eeb69f4c6ae5df19f2cdb31be982ae8ae
Size

124KB
Sample

221123-sy2zbaff7x
MD5

99116630e9d9e0e85eb176b7b420c651
SHA1

402b9b880a4262f617d5659958b05caed9f73b7c
SHA256

bb61e1a70b151c6fd4e4bfd1bcd4048eeb69f4c6ae5df19f2cdb31be982ae8ae
SHA512

8d1129c8fde6cf8b267b22acf8011aab791f5852e9f1f73fb6edc89b86d2f1fc3c83239e73f3005db03b49b2957bc862c53bb37b6ec6940b0601ad897682aa7c
SSDEEP

3072:fwQoEawyoHczQXKooUG57oS7BVhyYlXhciLx7JJ5Wzquz:faEaackXKoo5sIB/XxLTe

Score

10^/10

netwire botnet persistence rat stealer

Static task

static1

Behavioral task

behavioral1

Sample

bb61e1a70b151c6fd4e4bfd1bcd4048eeb69f4c6ae5df19f2cdb31be982ae8ae.exe

Resource

win7-20220812-en

netwire botnet persistence rat stealer

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

bb61e1a70b151c6fd4e4bfd1bcd4048eeb69f4c6ae5df19f2cdb31be982ae8ae.exe

Resource

win10v2004-20220812-en

netwire botnet persistence rat stealer

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  bb61e1a70b151c6fd4e4bfd1bcd4048eeb69f4c6ae5df19f2cdb31be982ae8ae
- Size
  
  124KB
- MD5
  
  99116630e9d9e0e85eb176b7b420c651
- SHA1
  
  402b9b880a4262f617d5659958b05caed9f73b7c
- SHA256
  
  bb61e1a70b151c6fd4e4bfd1bcd4048eeb69f4c6ae5df19f2cdb31be982ae8ae
- SHA512
  
  8d1129c8fde6cf8b267b22acf8011aab791f5852e9f1f73fb6edc89b86d2f1fc3c83239e73f3005db03b49b2957bc862c53bb37b6ec6940b0601ad897682aa7c
- SSDEEP
  
  3072:fwQoEawyoHczQXKooUG57oS7BVhyYlXhciLx7JJ5Wzquz:faEaackXKoo5sIB/XxLTe
Score

10^/10

netwire botnet persistence rat stealer
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

netwirebotnetpersistenceratstealer

behavioral2

netwirebotnetpersistenceratstealer

© 2018-2024

Terms | Privacy