netwire | 0f66efcad1e16c256ee6910110caa70de9f84fee520dda97e61768ce2efe1155

General

Target

0f0298d80bf7369901281c60cb3c6143_JaffaCakes118.exe
Size

423KB
MD5

0f0298d80bf7369901281c60cb3c6143
SHA1

f0158722de8b28bfb05e48c8d6d458035da8e75d
SHA256

0f66efcad1e16c256ee6910110caa70de9f84fee520dda97e61768ce2efe1155
SHA512

3bdc35ceb3977b0d37cfe70d44071b2991ef99530e806e7f68f604b54290ff1fb985e9c8df3c1744ac48198c67a9c802fb2456e9eec98eabf5206454febc7369
SSDEEP

6144:QsCwu+mWhJifvtNP/7YXSLB80PqO/PhR3pDnqq+bF/FvuY5KyGGRkjXg9kiqi1bx:NxmIJQvPkitEqZR3pDqq+7WUfw7wai1N

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

bossback.camdvr.org:5934

imglb.zapto.org:5934

Attributes

activex_autorun
true
activex_key
{C75DMOOV-L0WV-EW1N-586E-844U6R168E1R}
copy_executable
true
delete_original
false
host_id
DOLLARS
install_path
%AppData%\Install\adobereader.exe
keylogger_dir
%AppData%\Logs\
lock_executable
true
mutex
EmoQFkvY
offline_keylogger
true
password
Hunter45
registry_autorun
true
startup_name
Powerpoint
use_mutex
true

Signatures

NetWire RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/files/0x0008000000015cf6-26.dat	netwire
behavioral1/memory/2924-46-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/1908-47-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/1908-54-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C75DMOOV-L0WV-EW1N-586E-844U6R168E1R}	adobereader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C75DMOOV-L0WV-EW1N-586E-844U6R168E1R}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\adobereader.exe\""	adobereader.exe

Executes dropped EXE 3 IoCs

pid	Process
1436	excel.sfx.exe
2924	excel.exe
1908	adobereader.exe

Loads dropped DLL 7 IoCs

pid	Process
2620	cmd.exe
1436	excel.sfx.exe
1436	excel.sfx.exe
1436	excel.sfx.exe
1436	excel.sfx.exe
2924	excel.exe
2924	excel.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Powerpoint = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\adobereader.exe"	adobereader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2620	2392	0f0298d80bf7369901281c60cb3c6143_JaffaCakes118.exe	28
PID 2392 wrote to memory of 2620	2392	0f0298d80bf7369901281c60cb3c6143_JaffaCakes118.exe	28
PID 2392 wrote to memory of 2620	2392	0f0298d80bf7369901281c60cb3c6143_JaffaCakes118.exe	28
PID 2392 wrote to memory of 2620	2392	0f0298d80bf7369901281c60cb3c6143_JaffaCakes118.exe	28
PID 2620 wrote to memory of 1436	2620	cmd.exe	30
PID 2620 wrote to memory of 1436	2620	cmd.exe	30
PID 2620 wrote to memory of 1436	2620	cmd.exe	30
PID 2620 wrote to memory of 1436	2620	cmd.exe	30
PID 1436 wrote to memory of 2924	1436	excel.sfx.exe	31
PID 1436 wrote to memory of 2924	1436	excel.sfx.exe	31
PID 1436 wrote to memory of 2924	1436	excel.sfx.exe	31
PID 1436 wrote to memory of 2924	1436	excel.sfx.exe	31
PID 2924 wrote to memory of 1908	2924	excel.exe	32
PID 2924 wrote to memory of 1908	2924	excel.exe	32
PID 2924 wrote to memory of 1908	2924	excel.exe	32
PID 2924 wrote to memory of 1908	2924	excel.exe	32

C:\Users\Admin\AppData\Local\Temp\0f0298d80bf7369901281c60cb3c6143_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f0298d80bf7369901281c60cb3c6143_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\uid.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\excel.sfx.exe
    excel.sfx.exe -p127 -dC:\Users\Admin\AppData\Local\Temp
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\excel.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\excel.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2924
    - - C:\Users\Admin\AppData\Roaming\Install\adobereader.exe
        
        "C:\Users\Admin\AppData\Roaming\Install\adobereader.exe"
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\excel.sfx.exe

Filesize
296KB

MD5
e894fa827ab90bd902089ba99d36e539

SHA1
f5576b3e4895446539a72cb87e5074fc415fd456

SHA256
f4938af998cd8f61386779785132162670b7fb4d290ccf6513b35e9d0abcf57b

SHA512
15a9c7ecd4497b9141a40e2ac1c16538974589c700680dd67dabbb2d052435d14894472cbcb8402eaa08f3569a3dca1878f2e1afc0c6aac20bcda70fd429bb08

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\uid.bat

Filesize
28B

MD5
5fb3962b08761523c6d6ec0d9f5ca6bb

SHA1
47d767e683aafaf51494489b7890345ce3733772

SHA256
de39a5104e4a1e3b6778cd6a3d6ab773dd0de56e23d9e952633210b1a14037d2

SHA512
d5ba79ed1d619568668f784973607edd3713373d5ed427d2676d66620f27ca8ca5b657f830a81d07c23f34f6be20f71e5c1136cf241ca45145937e7a4e030f64

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\excel.exe

Filesize
132KB

MD5
4532c1df5b6d4a43ef0af01919f5e6a4

SHA1
28b11a6b4dcdaf553aafbf168fa4fd6d3181abd3

SHA256
9202386a66faa666852ea9698ba754a6499cd3f382e725b440e21ea174748aef

SHA512
4982e5cf0c6b5118da16ffa94893c7a35839e9639fba8b37f16ca94ff3a4e64f619eaf14f317958c5e63c4f237877560aadc6627400baec8f944b1f43b2fb9da

Download Submit
memory/1908-47-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1908-54-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2924-46-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads