Overview

overview

10

Static

static

3

54b1eec1d1...20.exe

windows7-x64

10

54b1eec1d1...20.exe

windows10-2004-x64

10

54b1eec1d1...20.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    54b1eec1d1aafed3f6d18fd961d5af59c6e064f7b419dc91f75fe60c2c859e20.zip

  • Size

    149KB

  • Sample

    250303-ztg7nsypx4

  • MD5

    8f3273c83ace81f3441a988fa1cce3c5

  • SHA1

    5109bee105bac867a3135aa6002de7ac01dfde34

  • SHA256

    fd79ff6034cee98ca2f1f28d60a935528c960f0a3d7f7e007c4a2ab0eb3b9579

  • SHA512

    14435079dc3d203b8e0d5d50f6b3fb32082dd896ea3a25db0ed527f19d0a0058135d0e25e9621c7cb95eeaa3247a63f7dea668dea19cd8dbcf49dcfdf51c6e64

  • SSDEEP

    3072:nnP7gnfG9hhhG9MDla+aT/koHkPgHhZi+EDve57O84tM3bftdun:nTHz5DI+aDkoziTSgvYbVdun

Score
10/10
netwirebotnetdiscoverypersistenceratstealer

Malware Config

Extracted

Family

netwire

C2

163.172.122.160:6880

officeusd.hopto.org:6882

officeusd.freedynamicdns.org:6881
Attributes
  • activex_autorun

    true

  • activex_key

    {N7037D4A-2XYB-3F80-7Y3N-NWDNM4H1232P}

  • copy_executable

    true

  • delete_original

    true

  • host_id

    USD

  • install_path

    %AppData%\Install\MicrosoftWindow.exe

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    true

  • mutex

    HpxSfhNV

  • offline_keylogger

    true

  • password

    nobility007

  • registry_autorun

    true

  • startup_name

    MSWindow

  • use_mutex

    true

Targets

    • Target

      54b1eec1d1aafed3f6d18fd961d5af59c6e064f7b419dc91f75fe60c2c859e20

    • Size

      312KB

    • MD5

      da25f7f495802094fb5a21e2584d53e8

    • SHA1

      c4c7661b9456e745402009e3270e1db4f99b91c3

    • SHA256

      54b1eec1d1aafed3f6d18fd961d5af59c6e064f7b419dc91f75fe60c2c859e20

    • SHA512

      f56ae1a67bc0761d5edfc626313519443b7699c511bdc57713fd4c6e2af522fb5d0ef6dc98def75c5ba87dafa7550cc4bb1d666a48d5d395978347b114f2876e

    • SSDEEP

      6144:o4/EUyRQtOMdnvMMavQZSZOgfpMl8hybZERd:7/pOMdnvnavQZSZHMehy1U

    Score
    10/10
    netwirebotnetdiscoverypersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Netwire family

      netwire

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Tasks