Overview

overview

10

Static

static

7

NEAS.fae69...f0.exe

windows7-x64

10

NEAS.fae69...f0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.fae6906ee3443b5c896927fd87be8ff0.exe

  • Size

    790KB

  • Sample

    231026-a2vqasaa99

  • MD5

    fae6906ee3443b5c896927fd87be8ff0

  • SHA1

    67ed611bf411ebde3d33e14980e15fa44368f9d1

  • SHA256

    7e084dcdb04c98da8d7f238b107056fa2ee936cfdf0486c89719c99f9a90220f

  • SHA512

    7cc661b1e429553f5fe3f22359a4ab170cfbe40c54021852c751ab19d2563f69232d12888ea6e6faed7ef64e518ade1adf38cb688f51c6d556e9c3f74260c4c2

  • SSDEEP

    24576:3BXY+ruBJ5antl8yYEcAwQ1nFN8LcGTsj:3OoneE90rk

Score
10/10
netwirebotnetpersistenceratstealerupx

Malware Config

Extracted

Family

netwire

C2

155.94.198.169:9112

Attributes
  • activex_autorun

    false

  • copy_executable

    true

  • delete_original

    false

  • host_id

    Corona-Virus

  • install_path

    %AppData%\Install\offiice365.exe

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Pounds

  • registry_autorun

    true

  • startup_name

    officeii365

  • use_mutex

    false

Targets

    • Target

      NEAS.fae6906ee3443b5c896927fd87be8ff0.exe

    • Size

      790KB

    • MD5

      fae6906ee3443b5c896927fd87be8ff0

    • SHA1

      67ed611bf411ebde3d33e14980e15fa44368f9d1

    • SHA256

      7e084dcdb04c98da8d7f238b107056fa2ee936cfdf0486c89719c99f9a90220f

    • SHA512

      7cc661b1e429553f5fe3f22359a4ab170cfbe40c54021852c751ab19d2563f69232d12888ea6e6faed7ef64e518ade1adf38cb688f51c6d556e9c3f74260c4c2

    • SSDEEP

      24576:3BXY+ruBJ5antl8yYEcAwQ1nFN8LcGTsj:3OoneE90rk

    Score
    10/10
    netwirebotnetpersistenceratstealerupx

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks