Overview

overview

10

Static

static

1

2b9921ac79...5a.exe

windows7-x64

10

2b9921ac79...5a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2b9921ac79908737bfe2ccef8f3d5741b3e520d9141732ac2b4512944f1cd75a

  • Size

    122KB

  • Sample

    221128-qmgg5abd5x

  • MD5

    9ff5d58cf0757ff0bf356c49680f0cc3

  • SHA1

    9ca1083de077af72213b9bdaa92a0da435ccbf56

  • SHA256

    2b9921ac79908737bfe2ccef8f3d5741b3e520d9141732ac2b4512944f1cd75a

  • SHA512

    db17686a2821011af6bfe4f0e371a5d234ba5467d987530fb38d0c69b5616c2026e9f6304e5e62f3297ff78cc2971011db87daf9a735f81f1a3d12a13e250214

  • SSDEEP

    3072:gM1BjoYNXoKDIJBXJPtWrSxKubAAU5xqvfjmnKmpmc/6tXJRiT:gMMYNXqBBsuxKubAAUE7OKmB/GXJRiT

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      2b9921ac79908737bfe2ccef8f3d5741b3e520d9141732ac2b4512944f1cd75a

    • Size

      122KB

    • MD5

      9ff5d58cf0757ff0bf356c49680f0cc3

    • SHA1

      9ca1083de077af72213b9bdaa92a0da435ccbf56

    • SHA256

      2b9921ac79908737bfe2ccef8f3d5741b3e520d9141732ac2b4512944f1cd75a

    • SHA512

      db17686a2821011af6bfe4f0e371a5d234ba5467d987530fb38d0c69b5616c2026e9f6304e5e62f3297ff78cc2971011db87daf9a735f81f1a3d12a13e250214

    • SSDEEP

      3072:gM1BjoYNXoKDIJBXJPtWrSxKubAAU5xqvfjmnKmpmc/6tXJRiT:gMMYNXqBBsuxKubAAUE7OKmB/GXJRiT

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks