Overview

overview

10

Static

static

3

55230c3078...05.exe

windows7-x64

10

55230c3078...05.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    55230c307898ecf9cde4abe61d12f60188fe68572440e28948dbf8e9b40ee905.exe

  • Size

    2.2MB

  • Sample

    250123-d8gc2azphs

  • MD5

    5360ef1e31488f58a10481e97bc99189

  • SHA1

    03a5a885f8cb0c06189768515763b764c2cc14ee

  • SHA256

    55230c307898ecf9cde4abe61d12f60188fe68572440e28948dbf8e9b40ee905

  • SHA512

    919f8d756466ec9ca46e855449f7183be1bdfc842e875147c8d9fa31c9a8e0ed72f9b1f1ff5faf1a618eba581dfdc2e1341501f73167bf475281bd52c93ef53a

  • SSDEEP

    49152:5/dYw5NiJQgm+pUepZG2rIPHRTA449qILWhgn:dqEQJQgJmep/OxTPwqILWhc

Score
10/10
netwirebotnetdiscoverypersistenceratstealer

Malware Config

Extracted

Family

netwire

C2

javaupdate.100chickens.biz:6988

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    true

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    XubCoRQh

  • offline_keylogger

    true

  • password

    123

  • registry_autorun

    false

  • use_mutex

    true

Targets

    • Target

      55230c307898ecf9cde4abe61d12f60188fe68572440e28948dbf8e9b40ee905.exe

    • Size

      2.2MB

    • MD5

      5360ef1e31488f58a10481e97bc99189

    • SHA1

      03a5a885f8cb0c06189768515763b764c2cc14ee

    • SHA256

      55230c307898ecf9cde4abe61d12f60188fe68572440e28948dbf8e9b40ee905

    • SHA512

      919f8d756466ec9ca46e855449f7183be1bdfc842e875147c8d9fa31c9a8e0ed72f9b1f1ff5faf1a618eba581dfdc2e1341501f73167bf475281bd52c93ef53a

    • SSDEEP

      49152:5/dYw5NiJQgm+pUepZG2rIPHRTA449qILWhgn:dqEQJQgJmep/OxTPwqILWhc

    Score
    10/10
    netwirebotnetdiscoverypersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Netwire family

      netwire

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks