Malware Analysis Report

2025-06-15 21:06

Sample ID 220817-g9glzaegc9
Target Payment_PDF.js
SHA256 c3bd44142ca1e00f28b4a76267258f6086e776f02ca87f1f96002636e3f4ba8f
Tags
netwire vjw0rm botnet persistence rat stealer trojan worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c3bd44142ca1e00f28b4a76267258f6086e776f02ca87f1f96002636e3f4ba8f

Threat Level: Known bad

The file Payment_PDF.js was found to be: Known bad.

Malicious Activity Summary

netwire vjw0rm botnet persistence rat stealer trojan worm

NetWire RAT payload

Netwire

Vjw0rm

Blocklisted process makes network request

Executes dropped EXE

Drops startup file

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-08-17 06:30

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-08-17 06:30

Reported

2022-08-17 06:32

Platform

win7-20220812-en

Max time kernel

150s

Max time network

154s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\Payment_PDF.js

Signatures

NetWire RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Netwire

botnet stealer netwire

Vjw0rm

trojan worm vjw0rm

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rQhOtXJthh.js C:\Windows\System32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rQhOtXJthh.js C:\Windows\System32\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Note.lnk C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\£2ëUíaÊ—KåL¦K®¨æ = "C:\\Users\\Admin\\AppData\\Roaming\\Googlee\\Notepad.exe" C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe N/A

Enumerates physical storage devices

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\Payment_PDF.js

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\rQhOtXJthh.js"

C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe

"C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe"

C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe

"C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe"

Network

Country Destination Domain Proto
NL 171.22.30.21:3359 tcp
US 8.8.8.8:53 macjoe597.duia.ro udp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp

Files

memory/112-54-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

memory/1104-55-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\rQhOtXJthh.js

MD5 6184bcc6205df8fddaeb86b9aa52deff
SHA1 ac7ac3935f5874332afd575d52258615b2af7f17
SHA256 baa17c7098f3e39a29fda9a0d4e1378e6c0501705e49b11f982c4b320bf1a37f
SHA512 c0b9e457d8e5acadbd3c6a0e2cd54d29edd4dd37aa9e03692c95728ca1fe0dbfad3161adf75d27895e94cd7828f19369bb5b04b16e25cf6dd4d15d2961c2cb03

memory/2040-57-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe

MD5 fc6330d62ae89347dddf9e98d6dc2533
SHA1 b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA256 72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA512 1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c

memory/2040-59-0x0000000074C11000-0x0000000074C13000-memory.dmp

C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe

MD5 fc6330d62ae89347dddf9e98d6dc2533
SHA1 b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA256 72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA512 1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c

\Users\Admin\AppData\Roaming\Googlee\Notepad.exe

MD5 fc6330d62ae89347dddf9e98d6dc2533
SHA1 b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA256 72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA512 1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c

\Users\Admin\AppData\Roaming\Googlee\Notepad.exe

MD5 fc6330d62ae89347dddf9e98d6dc2533
SHA1 b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA256 72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA512 1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c

memory/720-64-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe

MD5 fc6330d62ae89347dddf9e98d6dc2533
SHA1 b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA256 72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA512 1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c

C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe

MD5 fc6330d62ae89347dddf9e98d6dc2533
SHA1 b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA256 72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA512 1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c

\Users\Admin\AppData\Roaming\Googlee\Notepad.exe

MD5 fc6330d62ae89347dddf9e98d6dc2533
SHA1 b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA256 72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA512 1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c

Analysis: behavioral2

Detonation Overview

Submitted

2022-08-17 06:30

Reported

2022-08-17 06:32

Platform

win10v2004-20220812-en

Max time kernel

149s

Max time network

154s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\Payment_PDF.js

Signatures

NetWire RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Netwire

botnet stealer netwire

Vjw0rm

trojan worm vjw0rm

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Control Panel\International\Geo\Nation C:\Windows\system32\wscript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rQhOtXJthh.js C:\Windows\System32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rQhOtXJthh.js C:\Windows\System32\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Note.lnk C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\£2ëUíaÊ—KåL¦K®¨æ = "C:\\Users\\Admin\\AppData\\Roaming\\Googlee\\Notepad.exe" C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe N/A

Enumerates physical storage devices

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\Payment_PDF.js

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\rQhOtXJthh.js"

C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe

"C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe"

C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe

"C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 macjoe597.duia.ro udp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
NL 171.22.30.21:3359 tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
NL 104.80.225.205:443 tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
US 20.44.10.123:443 tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
US 13.107.4.50:80 tcp
US 13.107.4.50:80 tcp
US 13.107.4.50:80 tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp
CH 91.192.100.8:8159 macjoe597.duia.ro tcp

Files

memory/1528-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\rQhOtXJthh.js

MD5 6184bcc6205df8fddaeb86b9aa52deff
SHA1 ac7ac3935f5874332afd575d52258615b2af7f17
SHA256 baa17c7098f3e39a29fda9a0d4e1378e6c0501705e49b11f982c4b320bf1a37f
SHA512 c0b9e457d8e5acadbd3c6a0e2cd54d29edd4dd37aa9e03692c95728ca1fe0dbfad3161adf75d27895e94cd7828f19369bb5b04b16e25cf6dd4d15d2961c2cb03

memory/3780-134-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe

MD5 fc6330d62ae89347dddf9e98d6dc2533
SHA1 b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA256 72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA512 1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c

C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe

MD5 fc6330d62ae89347dddf9e98d6dc2533
SHA1 b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA256 72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA512 1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c

memory/5000-137-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe

MD5 fc6330d62ae89347dddf9e98d6dc2533
SHA1 b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA256 72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA512 1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c

C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe

MD5 fc6330d62ae89347dddf9e98d6dc2533
SHA1 b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA256 72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA512 1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c