Overview

overview

10

Static

static

PO 9047579...TZ.exe

windows7-x64

10

Resubmissions

11-01-2023 16:05

230111-tjr18shc9s 10

11-01-2023 16:03

230111-thmp5ahc8x 10

11-01-2023 10:15

230111-maal9sbg63 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO 9047579 FDX PREMIUM 96 NTZ.exe

  • Size

    621KB

  • Sample

    230111-tjr18shc9s

  • MD5

    ccc5553d844306dac7d4e112d27b6bf8

  • SHA1

    4699f3485ba9da714ea346c0aa1db2bb35947dda

  • SHA256

    5a8b1edfe9a05b20ec2ec3891cbe298913e9c8e29fae4e94411bc3766c907be2

  • SHA512

    bd8ded22ff3f94f9f5148938d2e880b1045549315b4127c5ed0a85183f0aac49d0091391328dfcce1509c7c982a0111e2f6339b093eb367a157409549e8be46c

  • SSDEEP

    12288:lAfWCREY+hUP5MMBn1CyvVwviXN4Nq0ymm82Ss0a15wKchkv3Am+8ubkw:6+07RBMMt1L9hwq0yb82SjywKcSvF+bf

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Extracted

Family

netwire

C2

212.193.30.230:6063

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • install_path

    %AppData%\Install\Host.exe

  • keylogger_dir

    TestLink.lnk

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    Password123@

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      PO 9047579 FDX PREMIUM 96 NTZ.exe

    • Size

      621KB

    • MD5

      ccc5553d844306dac7d4e112d27b6bf8

    • SHA1

      4699f3485ba9da714ea346c0aa1db2bb35947dda

    • SHA256

      5a8b1edfe9a05b20ec2ec3891cbe298913e9c8e29fae4e94411bc3766c907be2

    • SHA512

      bd8ded22ff3f94f9f5148938d2e880b1045549315b4127c5ed0a85183f0aac49d0091391328dfcce1509c7c982a0111e2f6339b093eb367a157409549e8be46c

    • SSDEEP

      12288:lAfWCREY+hUP5MMBn1CyvVwviXN4Nq0ymm82Ss0a15wKchkv3Am+8ubkw:6+07RBMMt1L9hwq0yb82SjywKcSvF+bf

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks