General
-
Target
709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66
-
Size
628KB
-
Sample
221130-n6z3gabh2v
-
MD5
c12e964ba585f9a9857075b8eb65d76b
-
SHA1
1add8089079732146f8488279366e0edbb642dea
-
SHA256
709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66
-
SHA512
8f6cd53cb37b42a5078cd7a3488f2209e88b135a94dd0684a6f8d24417f389070b67ecb74e801dd3ff3392cd1e956e8ad32120fca6cdb36c8a7a9e23ee8e06f2
-
SSDEEP
12288:Z25oGFLgYE9jz/Y3GTG8LKa+pCxBU2wgWD1+KjLQZ3Ntkf4VTqKlA7yTE:0VFEYE9XA3GnLtRWD1W3sf4V+Xk
Static task
static1
Behavioral task
behavioral1
Sample
709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
netwire
mamaput.duckdns.org:3369
-
activex_autorun
true
-
activex_key
{BF4QBRQX-XB5B-3NJ1-P10G-U11UC07H0K2W}
-
copy_executable
true
-
delete_original
false
-
host_id
winwin
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
gbam1234
-
registry_autorun
true
-
startup_name
NetWire
-
use_mutex
false
Targets
-
-
Target
709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66
-
Size
628KB
-
MD5
c12e964ba585f9a9857075b8eb65d76b
-
SHA1
1add8089079732146f8488279366e0edbb642dea
-
SHA256
709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66
-
SHA512
8f6cd53cb37b42a5078cd7a3488f2209e88b135a94dd0684a6f8d24417f389070b67ecb74e801dd3ff3392cd1e956e8ad32120fca6cdb36c8a7a9e23ee8e06f2
-
SSDEEP
12288:Z25oGFLgYE9jz/Y3GTG8LKa+pCxBU2wgWD1+KjLQZ3Ntkf4VTqKlA7yTE:0VFEYE9XA3GnLtRWD1W3sf4V+Xk
Score10/10-
NetWire RAT payload
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-