General
-
Target
fd2d9b3b2366b8b23e0f5f6f562f972aceaa9c3f2b6e7a523e2b072a03422e79
-
Size
562KB
-
Sample
221130-qmpthade89
-
MD5
3f37a617c0ac47ca476dfc3ce9a214fd
-
SHA1
830a64c95ba3d812de2021dc1e931b76326d9b2b
-
SHA256
fd2d9b3b2366b8b23e0f5f6f562f972aceaa9c3f2b6e7a523e2b072a03422e79
-
SHA512
6898844b8fc4c28e78e490e827e7b361ab089018a77134c992d9dbbced0f9cd1da3bcf2140aa0593937a104acf01efcbb0b2613a7b2621d93f9f2a7e2983e0d0
-
SSDEEP
12288:aEBDwqBGbanzcvPvcj+h/QEUo6den53XydJCoR:LwOGtcihQEURdOFo
Static task
static1
Behavioral task
behavioral1
Sample
fd2d9b3b2366b8b23e0f5f6f562f972aceaa9c3f2b6e7a523e2b072a03422e79.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fd2d9b3b2366b8b23e0f5f6f562f972aceaa9c3f2b6e7a523e2b072a03422e79.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
netwire
185.84.181.94:4376
-
activex_autorun
true
-
activex_key
{FX1MI827-36FJ-SX70-S6O1-DTD67404Y543}
-
copy_executable
true
-
delete_original
true
-
host_id
Panelsan
-
install_path
%AppData%\Install\Mswords.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
true
-
mutex
EiFjmhwr
-
offline_keylogger
true
-
password
<(/82?TM{V
-
registry_autorun
true
-
startup_name
Mswords
-
use_mutex
true
Targets
-
-
Target
fd2d9b3b2366b8b23e0f5f6f562f972aceaa9c3f2b6e7a523e2b072a03422e79
-
Size
562KB
-
MD5
3f37a617c0ac47ca476dfc3ce9a214fd
-
SHA1
830a64c95ba3d812de2021dc1e931b76326d9b2b
-
SHA256
fd2d9b3b2366b8b23e0f5f6f562f972aceaa9c3f2b6e7a523e2b072a03422e79
-
SHA512
6898844b8fc4c28e78e490e827e7b361ab089018a77134c992d9dbbced0f9cd1da3bcf2140aa0593937a104acf01efcbb0b2613a7b2621d93f9f2a7e2983e0d0
-
SSDEEP
12288:aEBDwqBGbanzcvPvcj+h/QEUo6den53XydJCoR:LwOGtcihQEURdOFo
Score10/10-
NetWire RAT payload
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-