Overview

overview

10

Static

static

3

1d92475e5f...18.exe

windows7-x64

10

1d92475e5f...18.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...sh.dll

windows7-x64

3

$PLUGINSDI...sh.dll

windows10-2004-x64

3

streamTran...st.exe

windows7-x64

7

streamTran...st.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1d92475e5f11ddf8256835c4bfb196a3_JaffaCakes118

  • Size

    175KB

  • Sample

    240506-vxw3saeg48

  • MD5

    1d92475e5f11ddf8256835c4bfb196a3

  • SHA1

    c40bc3e3fd25bf6b872b0e7953c9f5d833b522de

  • SHA256

    40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62

  • SHA512

    170fac19f61ade42c378811c6f11e91f62319c0b7ad77a9f1138db867bbd21ad48c54d1b3689b8e1d77be483e1a0b39bfe90dc6935e662c5f87aa823b8fc58d6

  • SSDEEP

    3072:NLuXzXwYyr6Dooc245Wi6BrurQddYuscHUA4nKH6TeKtZiM+CC55wl+:NpCbprurQduux4nK6eKtczCO2l+

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Extracted

Family

netwire

C2

37.233.101.73:8888

213.152.162.104:8747

213.152.162.170:8747

213.152.162.109:8747

213.152.162.89:8747

109.232.227.138:8747

109.232.227.133:8747

213.152.161.211:8747

213.152.162.94:8747

213.152.161.35:8747

213.152.180.5:8747
Attributes
  • activex_autorun

    true

  • activex_key

    {H15R52OJ-8CJI-H436-22TJ-P25072J3Q326}

  • copy_executable

    true

  • delete_original

    true

  • host_id

    IP

  • install_path

    %AppData%\Install\Host.exe

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    true

  • mutex

    bmhJQHdn

  • offline_keylogger

    true

  • password

    DAWAJkurwoKASEniePIERDOL

  • registry_autorun

    true

  • startup_name

    NetWire

  • use_mutex

    true

Targets

    • Target

      1d92475e5f11ddf8256835c4bfb196a3_JaffaCakes118

    • Size

      175KB

    • MD5

      1d92475e5f11ddf8256835c4bfb196a3

    • SHA1

      c40bc3e3fd25bf6b872b0e7953c9f5d833b522de

    • SHA256

      40c913b6837bb03dd168536710d88a05faa6a6956b1c210758a0979a6782bf62

    • SHA512

      170fac19f61ade42c378811c6f11e91f62319c0b7ad77a9f1138db867bbd21ad48c54d1b3689b8e1d77be483e1a0b39bfe90dc6935e662c5f87aa823b8fc58d6

    • SSDEEP

      3072:NLuXzXwYyr6Dooc245Wi6BrurQddYuscHUA4nKH6TeKtZiM+CC55wl+:NpCbprurQduux4nK6eKtczCO2l+

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Modifies Installed Components in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      3f176d1ee13b0d7d6bd92e1c7a0b9bae

    • SHA1

      fe582246792774c2c9dd15639ffa0aca90d6fd0b

    • SHA256

      fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

    • SHA512

      0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

    • SSDEEP

      192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/splash.dll

    • Size

      4KB

    • MD5

      4c5a0b9765cc0c33a0be7c802a41759f

    • SHA1

      7c38bcd7e4919b77b4249bc96919cf5bba5cc1d6

    • SHA256

      1aeae6b9e1a9f640e1cd1361b1a33dd60cd9e336015fcf1e022fe1fcd461df56

    • SHA512

      820cf514b26fcdef60200a1810fd11d1e075484ec8a762eca6005cccf98b7380613f28a9223a3133e331279dfb990adc5204b5cb7aa0f7e2d8c8f8700e4fed7d

    Score
    3/10
    behavioral5behavioral6

    • Target

      streamTranscoderv3-uninst.exe

    • Size

      51KB

    • MD5

      e3084822d9b2e96f7ed085a655df7557

    • SHA1

      35af7cc3e7fa5bb907cf6bd0a2ed3d5fa48cd25f

    • SHA256

      aa0e99f113c900c46e2735dae117000a71e0e1ac0bb5ce26d9629ca0751d9569

    • SHA512

      81a0fdc711530d50ab4f922dbcc25d1017eee3db7f12f29afe963c4c1593644e98a1dd0fd4ac4e8153b9c59a08eb63cc29b36876dbf431579196f79470676834

    • SSDEEP

      1536:kaLuXE8XPIYyr7jvN0DoJ+cKgdLeAyN04k:NLuXzXwYyr6DoocKceA8k

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks