Overview

overview

10

Static

static

10

1285bd095a...18.exe

windows7-x64

10

1285bd095a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1285bd095abb221e9ce84de643857a54_JaffaCakes118

  • Size

    127KB

  • Sample

    240504-njz4yscf4v

  • MD5

    1285bd095abb221e9ce84de643857a54

  • SHA1

    dc920e136edbd8fd5c1ed8b9e8a5c51fcef8b20b

  • SHA256

    2560d1a9dfa7398a9032fad992dc1939a0e014c736cee4b98a8dcc3433751afc

  • SHA512

    726922ea146f6057225cf3dfc6b8d241bbdd120e1ef9043461f958c0ffb53004c825654ff7138670a39d0cd9239ac97f90ea3d80f5f7683da5b379bfe371701f

  • SSDEEP

    3072:Uq3E2BfBSbEsz7nCAFVNNvBGvdO5gPaEjep8Fe7Z1iO7ZbvbLV7:BRBfBSosz7nCA3NHCdXaEj7Fe7Z1iOFR

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Extracted

Family

netwire

C2

automan.duckdns.org:3382

Attributes
  • activex_autorun

    false

  • copy_executable

    true

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • install_path

    %AppData%\Install\Host.exe

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    HDPAYslj

  • offline_keylogger

    true

  • password

    onelove82

  • registry_autorun

    true

  • startup_name

    NetWire

  • use_mutex

    true

Targets

    • Target

      1285bd095abb221e9ce84de643857a54_JaffaCakes118

    • Size

      127KB

    • MD5

      1285bd095abb221e9ce84de643857a54

    • SHA1

      dc920e136edbd8fd5c1ed8b9e8a5c51fcef8b20b

    • SHA256

      2560d1a9dfa7398a9032fad992dc1939a0e014c736cee4b98a8dcc3433751afc

    • SHA512

      726922ea146f6057225cf3dfc6b8d241bbdd120e1ef9043461f958c0ffb53004c825654ff7138670a39d0cd9239ac97f90ea3d80f5f7683da5b379bfe371701f

    • SSDEEP

      3072:Uq3E2BfBSbEsz7nCAFVNNvBGvdO5gPaEjep8Fe7Z1iO7ZbvbLV7:BRBfBSosz7nCA3NHCdXaEj7Fe7Z1iOFR

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks