Overview

overview

10

Static

static

3

6FC817F7C5...1D.exe

windows7-x64

10

6FC817F7C5...1D.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6FC817F7C53BEEA30C55D55779CEF31D.exe
  • Size 467KB
  • Sample240417-sdw8bsdc59
  • SHA256 9be6abe91db5212e333a086a8f9db157c08f7cf1eeb9020f6cf13444ddab8036
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Extracted

Family

  • netwire

C2

  • dnsresoIve.ns01.US:15111

  • dnsresolve.srz2l6.com:15111

  • PLUGINUPDATES.duckdns.org:15111

  • updateavlocalgenuine.com:15111

  • localupdate.ns02.info:15111

  • dnsresolve.nsl1.cc:15111

  • dnsresolve.srs8l2.com:15111

Attributes
  • activex_autorun

    false

  • activex_key

    {A3N5KUJ4-U7S4-6J45-1DJ6-32HM4W8Q0615}

  • copy_executable

    false

  • delete_original

    false

  • host_id

    AVR-%Rand%

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    DuleX

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target
      6FC817F7C53BEEA30C55D55779CEF31D.exe
    • Size 467KB
    • SHA256 9be6abe91db5212e333a086a8f9db157c08f7cf1eeb9020f6cf13444ddab8036
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Modifies Installed Components in the registry

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks