netwire | f1b4a215a84e80e11e558a5c995fd05fe34838aacf38763ca11d5714f4f63091

General

Target

2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe
Size

362KB
MD5

2a3f7f15ae8521504021f70d028c4b3d
SHA1

78130866eeaa2cc64fbdee360f18895058a81cad
SHA256

f1b4a215a84e80e11e558a5c995fd05fe34838aacf38763ca11d5714f4f63091
SHA512

05479fc0547c006d5fa39a12405433ac575dd5f7db00bc11176f1800ac70c7cc272a7d9aa8c5029e7949c766462441310de906c9503739fbe176ea2ede65751a
SSDEEP

6144:rR7PBeJA8J4bTXax4cK0jzzbRe8t35h6DUEVtI7j2:RPB/Wjde8tJhOUEtC

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

globalpersonaldns.ddns.net:54984

personalpractice1.hopto.org:54984

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
clients
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
vQSrxiLN
offline_keylogger
true
password
checkmate123
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/2564-15-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral1/memory/2564-18-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral1/memory/2564-21-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral1/memory/2564-22-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral1/memory/2564-34-0x0000000000400000-0x0000000000420000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Bitpay.exe.lnk	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2564	Bitpay.exe

Loads dropped DLL 1 IoCs

pid	Process
1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1720 set thread context of 2564	1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2736	timeout.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\nwjs\Bitpay.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe
1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe
1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe
1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe
1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe
1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe
1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe
1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe
1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe
1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe
1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe
1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe
1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe
1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe
1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2536	1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe	28
PID 1720 wrote to memory of 2536	1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe	28
PID 1720 wrote to memory of 2536	1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe	28
PID 1720 wrote to memory of 2536	1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe	28
PID 2536 wrote to memory of 280	2536	cmd.exe	30
PID 2536 wrote to memory of 280	2536	cmd.exe	30
PID 2536 wrote to memory of 280	2536	cmd.exe	30
PID 2536 wrote to memory of 280	2536	cmd.exe	30
PID 1720 wrote to memory of 2564	1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe	31
PID 1720 wrote to memory of 2564	1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe	31
PID 1720 wrote to memory of 2564	1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe	31
PID 1720 wrote to memory of 2564	1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe	31
PID 1720 wrote to memory of 2564	1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe	31
PID 1720 wrote to memory of 2564	1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe	31
PID 1720 wrote to memory of 2564	1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe	31
PID 1720 wrote to memory of 2564	1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe	31
PID 1720 wrote to memory of 2564	1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe	31
PID 1720 wrote to memory of 2632	1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe	32
PID 1720 wrote to memory of 2632	1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe	32
PID 1720 wrote to memory of 2632	1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe	32
PID 1720 wrote to memory of 2632	1720	2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe	32
PID 2632 wrote to memory of 2736	2632	cmd.exe	34
PID 2632 wrote to memory of 2736	2632	cmd.exe	34
PID 2632 wrote to memory of 2736	2632	cmd.exe	34
PID 2632 wrote to memory of 2736	2632	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2a3f7f15ae8521504021f70d028c4b3d_JaffaCakes118.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe"
  2⤵
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\nwjs\Bitpay.exe.lnk" /f
    3⤵
    PID:280
- C:\Users\Admin\AppData\Local\Temp\Bitpay.exe
  "C:\Users\Admin\AppData\Local\Temp\Bitpay.exe"
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Roaming\nwjs\Bitpay.exe.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 69060
    3⤵
    - Delays execution with timeout.exe
    PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\nwjs\Bitpay.exe

Filesize
362KB

MD5
2a3f7f15ae8521504021f70d028c4b3d

SHA1
78130866eeaa2cc64fbdee360f18895058a81cad

SHA256
f1b4a215a84e80e11e558a5c995fd05fe34838aacf38763ca11d5714f4f63091

SHA512
05479fc0547c006d5fa39a12405433ac575dd5f7db00bc11176f1800ac70c7cc272a7d9aa8c5029e7949c766462441310de906c9503739fbe176ea2ede65751a

Download Submit
C:\Users\Admin\AppData\Roaming\nwjs\Bitpay.exe.bat

Filesize
202B

MD5
1417d92e6f1e735adc4a812ab8609217

SHA1
b7a2e8301ea37a49121e23d3b961ffebe07334b3

SHA256
ec6fba9f00c94107fcf80233d3a8d14f7f00620de0255ba3bef7efc06f86cd58

SHA512
288bf17712f16dfb87f81b6df3a82a7e88741fd0913b27f10eecea30ef19bb21e45a81e10cc830d1a2014cb48899b5e1cca09433b9805d75c978f84cffa4e7a0

Download Submit
\Users\Admin\AppData\Local\Temp\Bitpay.exe

Filesize
1.6MB

MD5
32827e69b293b99013bbbe37d029245d

SHA1
bc9f80a38f09354d71467a05b0c5a82c3f7dac53

SHA256
9250b89157770e3ab59a2c7e2dd6b12b3c61d9b7c6620c3b4727e4bfff10f01f

SHA512
58c9a072e2bea0a8f22b4e69512abafad271ca91f2e3d2b4233796dd3d83021aad1c6da69fc8f7e7ca7919d34bde941cb8b5d185b668168866d1180558b93cf5

Download Submit
memory/1720-1-0x00000000003E0000-0x0000000000420000-memory.dmp

Filesize
256KB

Download
memory/1720-2-0x0000000074940000-0x0000000074EEB000-memory.dmp

Filesize
5.7MB

Download
memory/1720-0-0x0000000074940000-0x0000000074EEB000-memory.dmp

Filesize
5.7MB

Download
memory/1720-33-0x0000000074940000-0x0000000074EEB000-memory.dmp

Filesize
5.7MB

Download
memory/2564-15-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2564-13-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2564-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2564-18-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2564-21-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2564-22-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2564-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2564-12-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2564-34-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing