Overview

overview

10

Static

static

1

1c97bcdc6e...18.exe

windows7-x64

10

1c97bcdc6e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1c97bcdc6e17cfb15b2af3195d8b1483_JaffaCakes118

  • Size

    307KB

  • Sample

    240506-p6z8xacc3t

  • MD5

    1c97bcdc6e17cfb15b2af3195d8b1483

  • SHA1

    db90a3c91ea56ff28cab23102ad888ab4f948862

  • SHA256

    2566d37d333be3c5a3492e43d3063693d871da852f3d205e677720221e90926f

  • SHA512

    4d74c4a5661d6094cd65af61c3817f6111d79bbe50237275b0e3472d273beb82be2946ce8c1785a04a5d34d649655ef08f6ce3d59a57c9138e076e2f3ee8ef0e

  • SSDEEP

    6144:lI5f9bJi0dHALTwN6yn60jhl91B1bFKOI4WytGJm05kYlBB:lI5VbZALTRynvvLbFKJytCD

Score
10/10
netwirebotnetpersistenceratstealerupx

Malware Config

Extracted

Family

netwire

C2

mommyreal.ddns.net:9595

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    true

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    true

  • offline_keylogger

    true

  • password

    mywill12

  • registry_autorun

    true

  • startup_name

    securityscan

  • use_mutex

    false

Targets

    • Target

      1c97bcdc6e17cfb15b2af3195d8b1483_JaffaCakes118

    • Size

      307KB

    • MD5

      1c97bcdc6e17cfb15b2af3195d8b1483

    • SHA1

      db90a3c91ea56ff28cab23102ad888ab4f948862

    • SHA256

      2566d37d333be3c5a3492e43d3063693d871da852f3d205e677720221e90926f

    • SHA512

      4d74c4a5661d6094cd65af61c3817f6111d79bbe50237275b0e3472d273beb82be2946ce8c1785a04a5d34d649655ef08f6ce3d59a57c9138e076e2f3ee8ef0e

    • SSDEEP

      6144:lI5f9bJi0dHALTwN6yn60jhl91B1bFKOI4WytGJm05kYlBB:lI5VbZALTRynvvLbFKJytCD

    Score
    10/10
    netwirebotnetpersistenceratstealerupx

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks