Overview

overview

10

Static

static

1

3b7965955c...93.exe

windows7-x64

10

3b7965955c...93.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3b7965955c76752c635a89d5124c15ec90a91e4469375976b860ba61e9f51b93

  • Size

    141KB

  • Sample

    221127-etk84shc39

  • MD5

    9f3a2c39b2697ccfb4fbd3a9317c3f8b

  • SHA1

    45af562894d49f33aa15316e3a975d8de13921a8

  • SHA256

    3b7965955c76752c635a89d5124c15ec90a91e4469375976b860ba61e9f51b93

  • SHA512

    f50efc6d91c1768a740db7e58eacc9d65d5f81fb3ea899c1533a31e3c276ae99f2fafdc9922c697e0c80ebe541bfe0265a492f5b19a9fb2fff60d9c0b4240428

  • SSDEEP

    3072:7Asj8MBX8s0oXJLrJY7+Ne4tgJFvcHWK9BAMprDgkZPU8n20PjK9vNPszT:7AsBZtK7+FtgJFvc2mrDgkZPUw20Pji8

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      3b7965955c76752c635a89d5124c15ec90a91e4469375976b860ba61e9f51b93

    • Size

      141KB

    • MD5

      9f3a2c39b2697ccfb4fbd3a9317c3f8b

    • SHA1

      45af562894d49f33aa15316e3a975d8de13921a8

    • SHA256

      3b7965955c76752c635a89d5124c15ec90a91e4469375976b860ba61e9f51b93

    • SHA512

      f50efc6d91c1768a740db7e58eacc9d65d5f81fb3ea899c1533a31e3c276ae99f2fafdc9922c697e0c80ebe541bfe0265a492f5b19a9fb2fff60d9c0b4240428

    • SSDEEP

      3072:7Asj8MBX8s0oXJLrJY7+Ne4tgJFvcHWK9BAMprDgkZPU8n20PjK9vNPszT:7AsBZtK7+FtgJFvc2mrDgkZPUw20Pji8

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks