netwire

General

Target

6d52f2b7d9647fe6b0d18023ddbfda15b334fcd23bfae236bd47aab0b32e88bb
Size

144KB
Sample

221125-nwaptsed33
MD5

a16758f2d038aca2fdee64cc38d9a4f4
SHA1

c1ad2e63fcdcc773a1a54d5303c368614118ce7b
SHA256

6d52f2b7d9647fe6b0d18023ddbfda15b334fcd23bfae236bd47aab0b32e88bb
SHA512

ff35848bb9e8cfaa2d73e35e31e6ac1343ceb7dbea2033b1db7cdced4100082f8fb3f5147e7543efe906522a98887ea12eb78d9a98973083655adbedcd36b0f8
SSDEEP

3072:lNLuMa8RUrSeCb5J+TnXJbRh+2E37ydsMAdl6GP6ZAtV:lN88RUrVU4L5f3E2dsMAdl6GP6ZA

Score

10^/10

Malware Config

Targets

- Target
  
  6d52f2b7d9647fe6b0d18023ddbfda15b334fcd23bfae236bd47aab0b32e88bb
- Size
  
  144KB
- MD5
  
  a16758f2d038aca2fdee64cc38d9a4f4
- SHA1
  
  c1ad2e63fcdcc773a1a54d5303c368614118ce7b
- SHA256
  
  6d52f2b7d9647fe6b0d18023ddbfda15b334fcd23bfae236bd47aab0b32e88bb
- SHA512
  
  ff35848bb9e8cfaa2d73e35e31e6ac1343ceb7dbea2033b1db7cdced4100082f8fb3f5147e7543efe906522a98887ea12eb78d9a98973083655adbedcd36b0f8
- SSDEEP
  
  3072:lNLuMa8RUrSeCb5J+TnXJbRh+2E37ydsMAdl6GP6ZAtV:lN88RUrVU4L5f3E2dsMAdl6GP6ZA
Score

10^/10

netwire botnet persistence rat stealer
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

NetWire RAT payload

Executes dropped EXE

Modifies Installed Components in the registry

Checks computer location settings

Deletes itself

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2