General
-
Target
9e3dac5c792d10815c94ae9474c93aa8.exe
-
Size
1.0MB
-
Sample
230222-naefwsba93
-
MD5
9e3dac5c792d10815c94ae9474c93aa8
-
SHA1
da3ffcfa7c41e842ea80548105fac93252149550
-
SHA256
e9b94cae938b5549cc9645b0e15337bc0ff894b9413305351937cf7831347d85
-
SHA512
69fe825e8c41cdc852407eb2d396344341ceeabcec2edb0bebe269245ca305796975a88d81d557b5cde3fe84c235fb4c26bbad60541b19709ede1240387c956b
-
SSDEEP
24576:bgky9IIScJ+HlZwRqm4QkoWp2xoKkcrETLwWmAae0:b7LwRqm48Wp2+KkcowWmAa
Static task
static1
Behavioral task
behavioral1
Sample
9e3dac5c792d10815c94ae9474c93aa8.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
9e3dac5c792d10815c94ae9474c93aa8.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
netwire
zekeriyasolek44.duckdns.org:3102
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
Valentine End
-
install_path
%Windows%\Windows DataPoint\Windows Data Start.exe
-
lock_executable
false
-
mutex
Windows
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Targets
-
-
Target
9e3dac5c792d10815c94ae9474c93aa8.exe
-
Size
1.0MB
-
MD5
9e3dac5c792d10815c94ae9474c93aa8
-
SHA1
da3ffcfa7c41e842ea80548105fac93252149550
-
SHA256
e9b94cae938b5549cc9645b0e15337bc0ff894b9413305351937cf7831347d85
-
SHA512
69fe825e8c41cdc852407eb2d396344341ceeabcec2edb0bebe269245ca305796975a88d81d557b5cde3fe84c235fb4c26bbad60541b19709ede1240387c956b
-
SSDEEP
24576:bgky9IIScJ+HlZwRqm4QkoWp2xoKkcrETLwWmAae0:b7LwRqm48Wp2+KkcowWmAa
Score10/10-
NetWire RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-