Overview

overview

10

Static

static

3

c83d319f8b...86.exe

windows7-x64

10

c83d319f8b...86.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ib.dll

windows7-x64

3

$PLUGINSDI...ib.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

National-C...2.html

windows7-x64

1

National-C...2.html

windows10-2004-x64

1

challenge.js

windows7-x64

1

challenge.js

windows10-2004-x64

1

maximenuckmobile.js

windows7-x64

1

maximenuckmobile.js

windows10-2004-x64

1

planet-phi...y.html

windows7-x64

1

planet-phi...y.html

windows10-2004-x64

1

template.js

windows7-x64

1

template.js

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c83d319f8b4f4ec7f158298617e52b99cb9cda0603799fc5789b6888791b2d86

  • Size

    185KB

  • Sample

    240424-zmczdahd2v

  • MD5

    38a2136cedc0162445b5cec855d85d44

  • SHA1

    71ea45dac1e072ad1afe791c3281d1a94bf71918

  • SHA256

    c83d319f8b4f4ec7f158298617e52b99cb9cda0603799fc5789b6888791b2d86

  • SHA512

    6f48d227588e40122aa44424502c23494b5d6f3b890f8445c69e0221b3e70b8198f3e173932edd59d1b047f944feaeadf3c87f145516550b658ed250c0d3e6e0

  • SSDEEP

    3072:yIWGC7W7BuDcYzIknj3WCW2EW5x45EWAzPAh/iAe4ggheTgmgWWEc9lj2neR6iPE:IGC7W7BUr6AOiAe4gkgHg/n12nS6c5Ml

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Extracted

Family

netwire

C2

45.63.76.86:1120

Attributes
  • activex_autorun

    true

  • activex_key

    {1R455CO6-36TS-LD3E-GQ01-UU88VXGO4JBR}

  • copy_executable

    true

  • delete_original

    false

  • host_id

    MaHustlKoNiBaje

  • install_path

    %AllUsersProfile%\Antivirus\VirusCleaner.exe

  • keylogger_dir

    %AllUsersProfile%\Logs\

  • lock_executable

    true

  • mutex

    GkkuSoNR

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    true

  • startup_name

    AntiVirusCleaner

  • use_mutex

    true

Targets

    • Target

      c83d319f8b4f4ec7f158298617e52b99cb9cda0603799fc5789b6888791b2d86

    • Size

      185KB

    • MD5

      38a2136cedc0162445b5cec855d85d44

    • SHA1

      71ea45dac1e072ad1afe791c3281d1a94bf71918

    • SHA256

      c83d319f8b4f4ec7f158298617e52b99cb9cda0603799fc5789b6888791b2d86

    • SHA512

      6f48d227588e40122aa44424502c23494b5d6f3b890f8445c69e0221b3e70b8198f3e173932edd59d1b047f944feaeadf3c87f145516550b658ed250c0d3e6e0

    • SSDEEP

      3072:yIWGC7W7BuDcYzIknj3WCW2EW5x45EWAzPAh/iAe4ggheTgmgWWEc9lj2neR6iPE:IGC7W7BUr6AOiAe4gkgHg/n12nS6c5Ml

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Modifies Installed Components in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      3e6bf00b3ac976122f982ae2aadb1c51

    • SHA1

      caab188f7fdc84d3fdcb2922edeeb5ed576bd31d

    • SHA256

      4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe

    • SHA512

      1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706

    • SSDEEP

      192:eP24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlbSl:T8QIl975eXqlWBrz7YLOlb

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/TypeLib.dll

    • Size

      3KB

    • MD5

      81cfdb94142e4067bc2e7ca6e6dd3a5d

    • SHA1

      fa72a2a239715a0b13c9533ae5cc77ded115759d

    • SHA256

      b9ebd82c053b744bbf13847212978ea6132377dbf5d7f84a7f15b4b5c2a13f81

    • SHA512

      c6fdd3023421418f5c89de9278c50084dbc2b1e81ac29d4a35edab5c40120dbc2820d1fb2ab720ff5795ef967dfa89307e9276c304a1a3e19c5c38b41de3d4b6

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/UserInfo.dll

    • Size

      4KB

    • MD5

      ea6e193ba899e776df9a8011509aabae

    • SHA1

      6496b6946a2649bd9a4ed88acd60cd304270cdd4

    • SHA256

      5bfbbda954e6ac97e5eefcce298ca3ee14d1d2b9b27ca58320e0940dfbfb57ee

    • SHA512

      f467a142e1272b4601d43b0c0a79a289cfb02d91a8604132435adc98a7cbf349a650b955e1f7020d5db622dfe4941f3f36a42b52577823efca7c845f75377ffc

    Score
    3/10
    behavioral7behavioral8

    • Target

      National-Conference-in-Sales-Management-3013382

    • Size

      17KB

    • MD5

      0a4a2e4a24592f8652dbc565c6a66a58

    • SHA1

      282d9004cde9e2a676f8228ff561e885cfb7aed5

    • SHA256

      0e3feedfdd5aacb3ce08e1973ffd86bd2708998a8339777e20936fce5c1c5264

    • SHA512

      f2b76e81302f9bc08fb9edb8e58773c7832bf9485e88dc054657d77b79041c66ca902bb872da1c5c119cd27042e52f09bd6fd3848baf353b674d0fb90894e7b2

    • SSDEEP

      384:+UZRj4nUSJol822bv85GX82FL+XmxZHglZ541Q+b+ipOh7veEBrUR3zczRvA+EG7:PZRj4nUSJol822bv8sXXSXYZHglZ5416

    Score
    1/10
    behavioral10behavioral9

    • Target

      challenge

    • Size

      8KB

    • MD5

      dd1274684075ce70b004944e8129e93d

    • SHA1

      1e06992a48a6b74150221a3c0e1a46f4197a248f

    • SHA256

      25d21a3a6b617e3a88073aab38c7e896b6e3a6de3ec0a2e71b914282e569f529

    • SHA512

      5d4956ebac47779920c3e4347d71a6a719afec9bd271e3898186524a33c8c21358a2b9edf8d560962b863ba10b97d85a606d5b27713188d7495c8227045d227d

    • SSDEEP

      192:jDLHvaTaGxfujbGegfEfswpGJ1kng/RgmQAFPEHVVEWAKjul5ODmUqF:rmaGxfubGNfEfswcVgvY+VBjukmUqF

    Score
    1/10
    behavioral11behavioral12

    • Target

      maximenuckmobile.js

    • Size

      6KB

    • MD5

      46603c413c393c9575b33f3330afc1ca

    • SHA1

      2203cad76739e8a301d5b4eecc1faf928154f152

    • SHA256

      6f010f776f492084c332626f6e3edf82846e7461e09dbec84f3413fe7a530c10

    • SHA512

      e76ee316a6322351ca727797d93086ede1a37aac5ece47ec7dc95f3106406bc0e20ea8d5523bc9bbf1dad4e3a673fc5649d974bde682aad55d09059635079592

    • SSDEEP

      96:36bn6PMpnMebd9DdfH3GrN5N77qXgFjhIP7S4YuAXHypc2VjZh+Me7uHIw6d:36601XFpmjhILsHx2BjHIw6d

    Score
    1/10
    behavioral13behavioral14

    • Target

      planet-philosophy.html

    • Size

      996B

    • MD5

      5cec327786d139b695754039c0a740eb

    • SHA1

      5cf1426f7f39ec276ea1b1da9ddc8bf14cff0ee8

    • SHA256

      a0c9f40c881627e27cce7fb403b92115345e62a8b34ce2d23357e71d161d7dc2

    • SHA512

      0648f0136598436d46ecf272f45fa5bbb5ad66d0f043d289a12f9971aae65bd6ecbeeeb7f070c80ce6fdd223c7b6f7a8e9f07e11d341bc7c7ffcba5b54acd27f

    Score
    1/10
    behavioral15behavioral16

    • Target

      template.js

    • Size

      1KB

    • MD5

      5c2caeb64fc97d72abdbb36f0e08eb4d

    • SHA1

      f937168b8206e1886d39d98ac0252b019bce33f5

    • SHA256

      ce6bb495c89ece63d70d40434176fa04ce5047eeb9e5aace93511aa2954e0038

    • SHA512

      360b6a349ccabeebf69de6b3033f2e0f6711fa6c15ace6a58e26baf30749aef88726359ced7686f6794182640b4b15099a9a9b9ab395123b22c60687c6fb2412

    Score
    1/10
    behavioral17behavioral18

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

4
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks