netwire

Sharing

Copy URL

Twitter E-mail

General

Target

0bcdcedca7fbafa1200492139b8e5f0d_JaffaCakes118
Size

243KB
Sample

240501-pqtq7aha33
MD5

0bcdcedca7fbafa1200492139b8e5f0d
SHA1

63c2e2136107950975b8d89ae7d1ae520b05fc3c
SHA256

257a617f6233df4361c8c430261293c3d016c4757b03692329a5d078f9eb0a51
SHA512

932d81552ce1e3194c8fe254a4b5f9f4ba05dabeef6dc4dffdefbbf30893c9b484f611279573934f735acbb07e3a3a15487906f4a963f5816e95cd32a451ba2e
SSDEEP

6144:0puB4nKupg1dRzRATfzf9+yY8B86FL1D55q:DB4Kua1dB+TD9NFB8wLJ55q

Score

10^/10

Malware Config

Extracted

Family

netwire

ddns.catamosky.biz:4886

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
APRIL
install_path
%AppData%\Install\Hostiuj.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
fhYmpchh
offline_keylogger
true
password
Trinidado1@
registry_autorun
true
startup_name
hostiuj
use_mutex
true

Targets

- Target
  
  0bcdcedca7fbafa1200492139b8e5f0d_JaffaCakes118
- Size
  
  243KB
- MD5
  
  0bcdcedca7fbafa1200492139b8e5f0d
- SHA1
  
  63c2e2136107950975b8d89ae7d1ae520b05fc3c
- SHA256
  
  257a617f6233df4361c8c430261293c3d016c4757b03692329a5d078f9eb0a51
- SHA512
  
  932d81552ce1e3194c8fe254a4b5f9f4ba05dabeef6dc4dffdefbbf30893c9b484f611279573934f735acbb07e3a3a15487906f4a963f5816e95cd32a451ba2e
- SSDEEP
  
  6144:0puB4nKupg1dRzRATfzf9+yY8B86FL1D55q:DB4Kua1dB+TD9NFB8wLJ55q
Score

10^/10

netwire botnet persistence rat stealer
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  3e277798b9d8f48806fbb5ebfd4990db
- SHA1
  
  d1ab343c5792bc99599ec7acba506e8ba7e05969
- SHA256
  
  fe19353288a08a5d2640a9c022424a1d20e4909a351f2114423e087313a40d7c
- SHA512
  
  84c9d4e2e6872277bffb0e10b292c8c384d475ad163fd0a47ca924a3c79077dfde880f535a171660f73265792554129161d079a10057d44e28e2d57ebc477e92
- SSDEEP
  
  192:d4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjsK72dwF7dBOne:Wn3T5KdHCMRD/R1cOnrjs+BO
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/LangDLL.dll
- Size
  
  5KB
- MD5
  
  b26b412d9f1050ad53f663c972fdcd9f
- SHA1
  
  7bc4ed444f3f8fd14c2c36784d828175bace8c17
- SHA256
  
  70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a
- SHA512
  
  ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46
- SSDEEP
  
  48:im14sjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0Jpof5d2D:F1EBl91Z7/ycNSCwV8TLZR0Wd2
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/StartMenu.dll
- Size
  
  7KB
- MD5
  
  12281b59f907027f4d374b8423e2b0f9
- SHA1
  
  21216630633bb6cc4aa9b1c5873f345bbe06b74c
- SHA256
  
  1cc68f4aef76d70d7326853f0e604ff3ac926c1dfe7aee7ad69a3259280a4e66
- SHA512
  
  7c8c7a5c7f8e6d7a0b5d54ad1bfc34831358487985bd64459cd22f45f82385f4740e7a62048b01759b79e3d0f05ccb8152d63c3d864f308146ce5c746a9296b6
- SSDEEP
  
  96:qgiqVPb3X8K8Kdr3gEq6nNdMk6Qiw290+q6LDtJ1tR3hhEl7y:qgiqVPgK8K9eIdE9B/tVhg7
Score

3^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  3f176d1ee13b0d7d6bd92e1c7a0b9bae
- SHA1
  
  fe582246792774c2c9dd15639ffa0aca90d6fd0b
- SHA256
  
  fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
- SHA512
  
  0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
- SSDEEP
  
  192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
Score

3^/10
behavioral10 behavioral9
- Target
  
  uninst.exe
- Size
  
  64KB
- MD5
  
  96910c8a8d4b7ede90a59c90d105c511
- SHA1
  
  413e570bcb74495a7d4dd8b96ab64aef381ee876
- SHA256
  
  8c3f7744fbc3b8280a578436a1c58eb12308d58285ae554ffed9e38c3742126f
- SHA512
  
  4a7308a754b8c137f24475785b00b00ff8705cfe795a17fadec4fff3f472bd53d177e85bae09e6b3799b7c35a5365b122c1f1517dfc22b1b5f73453474e37a14
- SSDEEP
  
  1536:5aLuXE8XPIYyr7jvN0DoJ+cGgdLeAyNxnrz2/a6Bb:0LuXzXwYyr6DoocGceAy3ua6Bb
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/LangDLL.dll
- Size
  
  5KB
- MD5
  
  b26b412d9f1050ad53f663c972fdcd9f
- SHA1
  
  7bc4ed444f3f8fd14c2c36784d828175bace8c17
- SHA256
  
  70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a
- SHA512
  
  ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46
- SSDEEP
  
  48:im14sjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0Jpof5d2D:F1EBl91Z7/ycNSCwV8TLZR0Wd2
Score

3^/10
behavioral13 behavioral14

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

NetWire RAT payload

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Deletes itself

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14