Overview

overview

10

Static

static

3

9bf329e795...33.exe

windows7-x64

10

9bf329e795...33.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9bf329e7953beea80c3dbb8e26886f42b54b46e2f79af7f86ed14b8d9b63be33.exe

  • Size

    296KB

  • Sample

    250123-crvcwsylcp

  • MD5

    cd33c4a8aaef3f7b498e0969a680e0f2

  • SHA1

    d21f8b6d0c039d048836ceb19be8242c254c79ad

  • SHA256

    9bf329e7953beea80c3dbb8e26886f42b54b46e2f79af7f86ed14b8d9b63be33

  • SHA512

    4a256aac97f158481df8ab6702182133fea84d5622ec51d3fb621ab761dd6356a7bae679d3d4fc7a5f7364c466dc48ded7adede64cc51195cab9d5f8dd4a9a58

  • SSDEEP

    3072:tg6pbDIqOnD6rdKRMvXs+oCTZG9QBNctlVeFAnhPQ12uDefLFmLf9WL5Bcxw6:5Ddrvv8O1Ga9qtH5mLfoAD

Score
10/10
netwirebotnetdiscoveryratstealer

Malware Config

Extracted

Family

netwire

C2

wealthyman.brasilia.me:39560

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    WEALTH

  • keylogger_dir

    %AppData%\music\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    sucess

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      9bf329e7953beea80c3dbb8e26886f42b54b46e2f79af7f86ed14b8d9b63be33.exe

    • Size

      296KB

    • MD5

      cd33c4a8aaef3f7b498e0969a680e0f2

    • SHA1

      d21f8b6d0c039d048836ceb19be8242c254c79ad

    • SHA256

      9bf329e7953beea80c3dbb8e26886f42b54b46e2f79af7f86ed14b8d9b63be33

    • SHA512

      4a256aac97f158481df8ab6702182133fea84d5622ec51d3fb621ab761dd6356a7bae679d3d4fc7a5f7364c466dc48ded7adede64cc51195cab9d5f8dd4a9a58

    • SSDEEP

      3072:tg6pbDIqOnD6rdKRMvXs+oCTZG9QBNctlVeFAnhPQ12uDefLFmLf9WL5Bcxw6:5Ddrvv8O1Ga9qtH5mLfoAD

    Score
    10/10
    netwirebotnetdiscoveryratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Netwire family

      netwire

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks