netwire | c96fa60d5e36b647c770f6b4f6100616a3cbe6cd447cc23e2c70554bd481ce93

General

Target

fae427a28c3af269c0cf71d7ba46844c_JaffaCakes118.exe
Size

648KB
MD5

fae427a28c3af269c0cf71d7ba46844c
SHA1

d5e0b9a1b831cad05d800f7567e1d521666c47d8
SHA256

c96fa60d5e36b647c770f6b4f6100616a3cbe6cd447cc23e2c70554bd481ce93
SHA512

58390bad18cf0a537fb76d22e0eb8bf7e39d0fe5121c5a0a5d22480324826ebab699d01a7e94e39a7f4df0c9d6a4a5df980c3d32f6ae4304eff648e39fe2d31b
SSDEEP

12288:mc9VYM7klPqRLgTRZkdOVrPEBXDXI1KOHVVwPzQlhWDp0aaryS37s:maVYMQyL4RZkds7aTXiKOHVWPWEDyaUs

Score

10^/10

netwire botnet persistence rat stealer upx

Malware Config

Extracted

Family

netwire

C2

155.94.198.169:9112

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
Corona-Virus
install_path
%AppData%\Install\offiice365.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Pounds
registry_autorun
true
startup_name
officeii365
use_mutex
false

Signatures

NetWire RAT payload 3 IoCs

rat

resource	yara_rule
behavioral1/files/0x00070000000120e4-2.dat	netwire
behavioral1/memory/3036-14-0x0000000000400000-0x0000000000430000-memory.dmp	netwire
behavioral1/memory/2484-17-0x0000000000400000-0x0000000000430000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Executes dropped EXE 2 IoCs

pid	Process
3036	test.exe
2484	offiice365.exe

Loads dropped DLL 4 IoCs

pid	Process
3016	cmd.exe
3016	cmd.exe
3036	test.exe
3036	test.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2872-0-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2872-16-0x0000000000400000-0x0000000000586000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\officeii365 = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\offiice365.exe"	offiice365.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 3016	2872	fae427a28c3af269c0cf71d7ba46844c_JaffaCakes118.exe	29
PID 2872 wrote to memory of 3016	2872	fae427a28c3af269c0cf71d7ba46844c_JaffaCakes118.exe	29
PID 2872 wrote to memory of 3016	2872	fae427a28c3af269c0cf71d7ba46844c_JaffaCakes118.exe	29
PID 2872 wrote to memory of 3016	2872	fae427a28c3af269c0cf71d7ba46844c_JaffaCakes118.exe	29
PID 3016 wrote to memory of 3036	3016	cmd.exe	30
PID 3016 wrote to memory of 3036	3016	cmd.exe	30
PID 3016 wrote to memory of 3036	3016	cmd.exe	30
PID 3016 wrote to memory of 3036	3016	cmd.exe	30
PID 3036 wrote to memory of 2484	3036	test.exe	31
PID 3036 wrote to memory of 2484	3036	test.exe	31
PID 3036 wrote to memory of 2484	3036	test.exe	31
PID 3036 wrote to memory of 2484	3036	test.exe	31

C:\Users\Admin\AppData\Local\Temp\fae427a28c3af269c0cf71d7ba46844c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fae427a28c3af269c0cf71d7ba46844c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c test.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Users\Admin\AppData\Local\Temp\test.exe
    test.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Users\Admin\AppData\Roaming\Install\offiice365.exe
      "C:\Users\Admin\AppData\Roaming\Install\offiice365.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\test.exe

Filesize
148KB

MD5
14ca6b976efad4a82c1e6210f30c36d4

SHA1
6e7532693c6f980f997e4d2a8c18c6229b38350f

SHA256
b7523c7c9f49080a9f807bbf4fde548cb78ccc1143fb43d3beb64dd19e3feb2e

SHA512
0fad931a5c1d6ce22a7b6b474f7cfedb0a2cb1d7ad06831e97ef9c0196bb95c5a9a064b449a3cd67c20e29c1e89d75c92e56471c4dd4cfca70aebbe6bb2eb26f

Download Submit
memory/2484-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2872-0-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2872-16-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/3036-14-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads