Overview

overview

10

Static

static

3

73a93786fa...3N.exe

windows7-x64

8

73a93786fa...3N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    73a93786fa6ce81d1d23389abfda250ea816514764d2fcc28e4837ad85fc1ba3N

  • Size

    178KB

  • Sample

    241106-vwjq3awqgl

  • MD5

    ba7842cb913de2aa30b8699a1f8f32d0

  • SHA1

    a2b2625d1bd2b0fd00ea5671856295bd9085bc10

  • SHA256

    73a93786fa6ce81d1d23389abfda250ea816514764d2fcc28e4837ad85fc1ba3

  • SHA512

    2860348364518430b49cffd42f98ecd74c9926940b942c635c1f6fa83440a344c678c2c72d185c41acb53e2bbfe5c4e8878f40de4f22ae3a31b3e8846344c50d

  • SSDEEP

    3072:I7VNBmjq8Kmvn6rIVTYC7H2rAalUW4R6rv3p8WStxlQu2VCPwV:I7VzxYnWI6agAalr4UrPp8WStPQu28I

Score
10/10
netwirebotnetdiscoveryevasionpersistenceratstealer

Malware Config

Extracted

Family

netwire

C2

wallou.publicvm.com:3365

mediafire.duckdns.org:3365
Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    DLL2

  • keylogger_dir

    %AppData%\System\

  • lock_executable

    true

  • mutex

    KgpcGWmM

  • offline_keylogger

    true

  • password

    Reborn

  • registry_autorun

    false

  • use_mutex

    true

Targets

    • Target

      73a93786fa6ce81d1d23389abfda250ea816514764d2fcc28e4837ad85fc1ba3N

    • Size

      178KB

    • MD5

      ba7842cb913de2aa30b8699a1f8f32d0

    • SHA1

      a2b2625d1bd2b0fd00ea5671856295bd9085bc10

    • SHA256

      73a93786fa6ce81d1d23389abfda250ea816514764d2fcc28e4837ad85fc1ba3

    • SHA512

      2860348364518430b49cffd42f98ecd74c9926940b942c635c1f6fa83440a344c678c2c72d185c41acb53e2bbfe5c4e8878f40de4f22ae3a31b3e8846344c50d

    • SSDEEP

      3072:I7VNBmjq8Kmvn6rIVTYC7H2rAalUW4R6rv3p8WStxlQu2VCPwV:I7VzxYnWI6agAalr4UrPp8WStPQu28I

    Score
    10/10
    discoveryevasionpersistencenetwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Netwire family

      netwire

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks