netwire

General

Target
7a6a6b35d4bc575897a1420134afc96a.bin
Size 136KB
Sample230627-b3dzlsdf2s
SHA256 5d60cf42ec246587b61801971341e3a137a87357b441f9fcb486e35fa4f8f9ca
MD5 080aa9dbc23ce9490ac8db3bbe2dca5c
SHA1 54ec46e119a91ebd496de611d8a927a174ef9975
SHA512 fd3eda2a5d30be925b5208fcc021cc5061044d5400a9cb82539f90a2b0b4fb920374ae86e6b09009b21f748e1e15ad9c8b09e66ee1cf467f3e38561098b5486d
SSDEEP 3072:HZ9VUMid7nDvz+KkCKSzNCO5MGzZiakk862fUOwS7WQVOb:jS/BDvZwmCOlik86Cmf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

netwire

C2

sosclient.duckdns.org:9002

Attributes

activex_autorun
true
activex_key
{OTGC73Q0-N4WA-4861-311L-BE075477ANH7}
copy_executable
false
delete_original
false
host_id
08-%Rand%
lock_executable
true
mutex
stostmDW
offline_keylogger
false
password
10203010Aa
registry_autorun
true
startup_name
Windows defender
use_mutex
true

Targets

- Target
  d15f99dbd30bae6e896c52a810fbcba080ae3ba76f3fc0d9a7761c5736ec7c81.exe
- Size 171KB
- SHA256 d15f99dbd30bae6e896c52a810fbcba080ae3ba76f3fc0d9a7761c5736ec7c81
- MD5 7a6a6b35d4bc575897a1420134afc96a
- SHA1 9c5e87ce87b70a52f57097172c2babde2021454b
- SHA512 b879c2bf81017f8f97d4db3b458d6f3ff6eb1acb6e28394d9a292d58e83194857c6c5981378170e81d383340eb3eff42d2d64ce54ebd7a3e7357988428da5d2e
- SSDEEP 3072:k/0CVy40hsbOeOyupBfOP8S6Uj9Av0fEdiFxFXwElgdEA/fLpujDqTrk3mjcqfZ:kswhwyJLjzfiib53W/fLpsDq/k7qf
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

netwire botnet persistence rat stealer
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Modifies Installed Components in the registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

NetWire RAT payload

Modifies Installed Components in the registry

Checks computer location settings

Drops startup file

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2