Overview

overview

10

Static

static

3

3aece3473d...26.exe

windows7-x64

10

3aece3473d...26.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    1s
  • max time network
    111s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 20:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3aece3473d0dc78b33efce273ac23626.exe

  • Size

    1.2MB

  • MD5

    3aece3473d0dc78b33efce273ac23626

  • SHA1

    64b35b31e90f6d569df2195f312f31d0d499a971

  • SHA256

    ddb36550d76aab46cf84a855f0e242d45a7fa4576f1b162fcf41026defecdc3d

  • SHA512

    77e81bf73fd795c9ece63b1eb8d0021bfaee3b6ac64d6cbe5a758e69666969b26451958622e9a2ac1fe00f4f907f2d69238c8b1cfa6cd5887e6bc83cff7d9284

  • SSDEEP

    24576:1AOcZu3wPvjWH0+74RZ5bM3+vT9TFsXc6z1F/iI:/NGjx+8m3uT9TWM6z1F/D

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

harold.ns01.info:3606

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    Netwir

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    pHJVBoFH

  • offline_keylogger

    true

  • password

    master12

  • registry_autorun

    false

  • use_mutex

    true

Signatures

  • NetWire RAT payload 3 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\3aece3473d0dc78b33efce273ac23626.exe
    "C:\Users\Admin\AppData\Local\Temp\3aece3473d0dc78b33efce273ac23626.exe"
    1⤵
      PID:4004
      • C:\Users\Admin\AppData\Roaming\11195509\icvsbsh.pif
        "C:\Users\Admin\AppData\Roaming\11195509\icvsbsh.pif" moeebd.wrc
        2⤵
          PID:2652
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            3⤵
              PID:2964

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2964-66-0x0000000000F00000-0x0000000001548000-memory.dmp

          Filesize

          6.3MB

          Download

        • memory/2964-68-0x0000000000F00000-0x0000000001548000-memory.dmp

          Filesize

          6.3MB

          Download

        • memory/2964-69-0x0000000000F00000-0x0000000001548000-memory.dmp

          Filesize

          6.3MB

          Download