Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-04-2024 01:47
Static task
static1
Behavioral task
behavioral1
Sample
e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe
-
Size
4.4MB
-
MD5
e8ef02beaf986390fcb537d1cb3d6a51
-
SHA1
fb47e64ccd6566032d7c85a89a8570270d8621a5
-
SHA256
370c78ecd539292a20e84dd4f58aaf5194a3b0db5ea857adfd46b50d6333426a
-
SHA512
8a488b90a5337acdf93a104e8aa963c9ca1d9d122606359f5629441b6ef2d745b35c9b6da2d3c85946bffdb0a8cf316c7f6db4bf967b67a064154143170bfc33
-
SSDEEP
98304:74AqGkgAo0Gkuv0VrN2OVDv4j24lilj1qT:74vlPqsrNAi9UT
Malware Config
Extracted
netwire
173.209.48.226:3360
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
C:\Users\Admin\AppData\Roaming\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2008-5-0x0000000002F30000-0x0000000002F63000-memory.dmp netwire behavioral1/memory/2008-7-0x0000000002F30000-0x0000000002F63000-memory.dmp netwire -
Drops startup file 1 IoCs
Processes:
DllHost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mm.exe.exe DllHost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exepid process 2008 e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe 2008 e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe 2008 e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe 2008 e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe 2008 e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe 2008 e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe 2008 e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe 2008 e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe 2008 e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe 2008 e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe 2008 e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe 2008 e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe 2008 e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe 2008 e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe 2008 e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe 2008 e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe 2008 e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe 2008 e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe 2008 e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe 2008 e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e8ef02beaf986390fcb537d1cb3d6a51_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2008
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
PID:1928