Overview

overview

10

Static

static

f9113f6d22...fa.exe

windows7-x64

10

f9113f6d22...fa.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f9113f6d2278ec7997fd0a713b5a49f68338cc75fba323af3c8c5ce2d06f9bfa

  • Size

    603KB

  • Sample

    230129-x6jj6acc7s

  • MD5

    3e1d28eea4116b42f5e1ddb09d269fc4

  • SHA1

    a9a0e4a7bc99de387567cade9b27e66e98ebc6f9

  • SHA256

    f9113f6d2278ec7997fd0a713b5a49f68338cc75fba323af3c8c5ce2d06f9bfa

  • SHA512

    7397d83ee8b6126247e1c82e97f1b85f3b95ffb087b22247f310aff5ee49e0e2ba5b23dd410353b13c7a6acf1ed72f0ea5ac67eacfa7f8e24571a5f1c22fd552

  • SSDEEP

    12288:EXRS22ZRIax1vuWWyaTXjV6IMurq08xySQ6FaSqLvp1cDeD6lpRLFjXK9SDhB8pM:3GTXMiSmhq9srpWE6NvrVQrlBRJ3hOZL

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Extracted

Family

netwire

C2

bambooo.dynu.net:8858

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    GAgoxrms

  • offline_keylogger

    true

  • password

    nesamone

  • registry_autorun

    false

  • use_mutex

    true

Targets

    • Target

      f9113f6d2278ec7997fd0a713b5a49f68338cc75fba323af3c8c5ce2d06f9bfa

    • Size

      603KB

    • MD5

      3e1d28eea4116b42f5e1ddb09d269fc4

    • SHA1

      a9a0e4a7bc99de387567cade9b27e66e98ebc6f9

    • SHA256

      f9113f6d2278ec7997fd0a713b5a49f68338cc75fba323af3c8c5ce2d06f9bfa

    • SHA512

      7397d83ee8b6126247e1c82e97f1b85f3b95ffb087b22247f310aff5ee49e0e2ba5b23dd410353b13c7a6acf1ed72f0ea5ac67eacfa7f8e24571a5f1c22fd552

    • SSDEEP

      12288:EXRS22ZRIax1vuWWyaTXjV6IMurq08xySQ6FaSqLvp1cDeD6lpRLFjXK9SDhB8pM:3GTXMiSmhq9srpWE6NvrVQrlBRJ3hOZL

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • Modifies WinLogon for persistence

      persistence

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks