Overview

overview

10

Static

static

8e72d092c3...07.exe

windows7-x64

10

8e72d092c3...07.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8e72d092c3b03fc26c62be9821c220881864925c58745c977a43480ac659f207

  • Size

    262KB

  • Sample

    221126-ks8kxaad61

  • MD5

    db4c8cf0e68a10693db27e6fca80225a

  • SHA1

    646d49587d76794e786db52aa3c1dbac337dfa82

  • SHA256

    8e72d092c3b03fc26c62be9821c220881864925c58745c977a43480ac659f207

  • SHA512

    d6253fa4552e48f09d3b71ed8262f1c3bb8cabf73a67ec2036c873e945a6a64a14a5db761c30384a53f6efeb35f66e0b55c7937a38449aada167668ba081276f

  • SSDEEP

    6144:opnmiELEbF0ItlfIJ6AXEdiI3myVhwA+l:opnm9op0qfdA7Ee

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      8e72d092c3b03fc26c62be9821c220881864925c58745c977a43480ac659f207

    • Size

      262KB

    • MD5

      db4c8cf0e68a10693db27e6fca80225a

    • SHA1

      646d49587d76794e786db52aa3c1dbac337dfa82

    • SHA256

      8e72d092c3b03fc26c62be9821c220881864925c58745c977a43480ac659f207

    • SHA512

      d6253fa4552e48f09d3b71ed8262f1c3bb8cabf73a67ec2036c873e945a6a64a14a5db761c30384a53f6efeb35f66e0b55c7937a38449aada167668ba081276f

    • SSDEEP

      6144:opnmiELEbF0ItlfIJ6AXEdiI3myVhwA+l:opnm9op0qfdA7Ee

    Score
    10/10
    netwirebotnetratstealerpersistence

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks