Overview

overview

10

Static

static

3

29926ffc10...c7.exe

windows7-x64

10

29926ffc10...c7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    33a3f1752ee6c63720aad8a9cc6787d9ebe80f01b319fad9338c53f6dd7995bd

  • Size

    149KB

  • Sample

    240901-gz2t6atgne

  • MD5

    94a09733e649e57dacc67577635603f0

  • SHA1

    36e6146c05a1e4e9fbdeaf55b2b13f13b57e65f0

  • SHA256

    33a3f1752ee6c63720aad8a9cc6787d9ebe80f01b319fad9338c53f6dd7995bd

  • SHA512

    b1c030b9e90a683138d4ce28a5e67186aa628c9ab14773a193f0ded91c313f76706fd9248e6df0da6e89f6c7a87a16b1f5409acc9b386d9e566bcf408c277825

  • SSDEEP

    3072:0h5WF6YEzN8+IAKmaYcsxHouRTMrFOxW0YHrGhkENaqHkw+eB8iD/St:0h5WF6iHmaYxxHdTMZNG1aQ/B8ibSt

Score
10/10
netwirebotnetdiscoveryratstealer

Malware Config

Extracted

Family

netwire

C2

globalpersonaldns.ddns.net:54984

personalpractice1.hopto.org:54984
Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    clients

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    vQSrxiLN

  • offline_keylogger

    true

  • password

    checkmate123

  • registry_autorun

    false

  • use_mutex

    true

Targets

    • Target

      29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7

    • Size

      404KB

    • MD5

      c03814b0ef1ae37561097cf94248c49e

    • SHA1

      7003dadb3576967c9b8a4a5c97976f004443b975

    • SHA256

      29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7

    • SHA512

      327cbafd0df5a52af396ba5fe49349d99e49ef61b5b4ab7f03fe616dae9db644bc2d9c21c28e1a5b758ed9d6441798be39ac5bfa37284e0a254d50847575edcd

    • SSDEEP

      6144:Tn77n8zu2DqpZUBDc2edbpIqAUwWIZwI64Q3dCw2BtBZ:H7nqArILUvIOMw

    Score
    10/10
    netwirebotnetdiscoveryratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks