Overview

overview

10

Static

static

5

2385d88ca5...f2.exe

windows7-x64

10

2385d88ca5...f2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2385d88ca5ab8b2b8bc155159d2592f2

  • Size

    4.8MB

  • Sample

    231225-q8yzasfed3

  • MD5

    2385d88ca5ab8b2b8bc155159d2592f2

  • SHA1

    c233168d0f36fa55768690119955ba79eb3ddd85

  • SHA256

    6238f606f5fd0fc1689731a503c42645ef7f383860071a4c70ad88d2c965102c

  • SHA512

    8c0bd8f73ae112f6ec0aa2d5fb379a73819026250feaa43aed1bfc05ae7e805a7c632820ccc3cb28bfdd9baca9f0e4157ef4f4a22e5c01a843b6182c86671671

  • SSDEEP

    98304:J2cPK8D+3cvKcBeITUhCBB5WKfEe5wsxBNB2+ODMiQmZwhtrUFY75sXmjl8T7g:wCKq+WcscCBaKfEex2++hZwhmEsXmR8Q

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Extracted

Family

netwire

C2

clients.enigmasolutions.xyz:54573

Attributes
  • activex_autorun

    false

  • copy_executable

    true

  • delete_original

    false

  • host_id

    Cleint-%Rand%

  • install_path

    %AppData%\Microsoft\Network\Network.exe

  • keylogger_dir

    %AppData%\msr\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    \tx>N(6H`Om2k/cWJBp,""bUbAd1-0Mg

  • registry_autorun

    true

  • startup_name

    ruj

  • use_mutex

    false

Targets

    • Target

      2385d88ca5ab8b2b8bc155159d2592f2

    • Size

      4.8MB

    • MD5

      2385d88ca5ab8b2b8bc155159d2592f2

    • SHA1

      c233168d0f36fa55768690119955ba79eb3ddd85

    • SHA256

      6238f606f5fd0fc1689731a503c42645ef7f383860071a4c70ad88d2c965102c

    • SHA512

      8c0bd8f73ae112f6ec0aa2d5fb379a73819026250feaa43aed1bfc05ae7e805a7c632820ccc3cb28bfdd9baca9f0e4157ef4f4a22e5c01a843b6182c86671671

    • SSDEEP

      98304:J2cPK8D+3cvKcBeITUhCBB5WKfEe5wsxBNB2+ODMiQmZwhtrUFY75sXmjl8T7g:wCKq+WcscCBaKfEex2++hZwhmEsXmR8Q

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks