netwire | 667c10a7b4f2f2804e25c238318f9b1861c968950bda3c13245570ad06c44bda

General

Target

5187f0ae3fc7ecd5b247cd1414c38400_JaffaCakes118.exe
Size

389KB
MD5

5187f0ae3fc7ecd5b247cd1414c38400
SHA1

36f96baef19fe58e3ce8b11638ff080658cd4390
SHA256

667c10a7b4f2f2804e25c238318f9b1861c968950bda3c13245570ad06c44bda
SHA512

4bbdbf59ed4000b04ee4519b18cf78c4affa4b226168deb4041fa4a06ae205d95189b4a26baa97a4941fa388c0c5ac8ec95dc3645949032b71460e9f5aa6d0be
SSDEEP

6144:NjOgBFDO7SlyYpVYNwKWy/8E4R9j/T/I2IAoC1RdTwHxQXP8Ryk6lBpVX9y:lrO2PjdHc8ES9j/mDqRdM6xk6Tv

Score

10^/10

netwire agilenet botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

99.38.102.122:3364

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
14438136789D
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2320-27-0x0000000000390000-0x00000000003BC000-memory.dmp	netwire
behavioral2/memory/2320-31-0x0000000000390000-0x00000000003BC000-memory.dmp	netwire
behavioral2/memory/2320-24-0x0000000000390000-0x00000000003BC000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5187f0ae3fc7ecd5b247cd1414c38400_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	5187f0ae3fc7ecd5b247cd1414c38400_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

javaw.exejavaw.exe

pid process

4196 javaw.exe
2320 javaw.exe

pid	process
4196	javaw.exe
2320	javaw.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/4196-19-0x0000000005560000-0x000000000556A000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

javaw.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java(TM) platform SE b = "C:\\Users\\Admin\\AppData\\Local\\javaw.exe -boot"	javaw.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

javaw.exe

description pid process target process

PID 4196 set thread context of 2320 4196 javaw.exe javaw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4128 2320 WerFault.exe javaw.exe

description	pid	process	target process
PID 4196 set thread context of 2320	4196	javaw.exe	javaw.exe

pid	pid_target	process	target process
4128	2320	WerFault.exe	javaw.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

5187f0ae3fc7ecd5b247cd1414c38400_JaffaCakes118.exejavaw.exe

description	pid	process
Token: SeDebugPrivilege	900	5187f0ae3fc7ecd5b247cd1414c38400_JaffaCakes118.exe
Token: 33	900	5187f0ae3fc7ecd5b247cd1414c38400_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	900	5187f0ae3fc7ecd5b247cd1414c38400_JaffaCakes118.exe
Token: SeDebugPrivilege	4196	javaw.exe
Token: 33	4196	javaw.exe
Token: SeIncBasePriorityPrivilege	4196	javaw.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

5187f0ae3fc7ecd5b247cd1414c38400_JaffaCakes118.execmd.exejavaw.exe

description	pid	process	target process
PID 900 wrote to memory of 4952	900	5187f0ae3fc7ecd5b247cd1414c38400_JaffaCakes118.exe	cmd.exe
PID 900 wrote to memory of 4952	900	5187f0ae3fc7ecd5b247cd1414c38400_JaffaCakes118.exe	cmd.exe
PID 900 wrote to memory of 4952	900	5187f0ae3fc7ecd5b247cd1414c38400_JaffaCakes118.exe	cmd.exe
PID 900 wrote to memory of 4592	900	5187f0ae3fc7ecd5b247cd1414c38400_JaffaCakes118.exe	cmd.exe
PID 900 wrote to memory of 4592	900	5187f0ae3fc7ecd5b247cd1414c38400_JaffaCakes118.exe	cmd.exe
PID 900 wrote to memory of 4592	900	5187f0ae3fc7ecd5b247cd1414c38400_JaffaCakes118.exe	cmd.exe
PID 4592 wrote to memory of 4196	4592	cmd.exe	javaw.exe
PID 4592 wrote to memory of 4196	4592	cmd.exe	javaw.exe
PID 4592 wrote to memory of 4196	4592	cmd.exe	javaw.exe
PID 4196 wrote to memory of 2320	4196	javaw.exe	javaw.exe
PID 4196 wrote to memory of 2320	4196	javaw.exe	javaw.exe
PID 4196 wrote to memory of 2320	4196	javaw.exe	javaw.exe
PID 4196 wrote to memory of 2320	4196	javaw.exe	javaw.exe
PID 4196 wrote to memory of 2320	4196	javaw.exe	javaw.exe
PID 4196 wrote to memory of 2320	4196	javaw.exe	javaw.exe
PID 4196 wrote to memory of 2320	4196	javaw.exe	javaw.exe
PID 4196 wrote to memory of 2320	4196	javaw.exe	javaw.exe
PID 4196 wrote to memory of 2320	4196	javaw.exe	javaw.exe
PID 4196 wrote to memory of 2320	4196	javaw.exe	javaw.exe

C:\Users\Admin\AppData\Local\Temp\5187f0ae3fc7ecd5b247cd1414c38400_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5187f0ae3fc7ecd5b247cd1414c38400_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\5187f0ae3fc7ecd5b247cd1414c38400_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\javaw.exe"
2⤵
PID:4952

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\javaw.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4592

C:\Users\Admin\AppData\Local\javaw.exe
"C:\Users\Admin\AppData\Local\javaw.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4196

C:\Users\Admin\AppData\Local\javaw.exe
"C:\Users\Admin\AppData\Local\javaw.exe"
4⤵
- Executes dropped EXE
PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 316
5⤵
- Program crash
PID:4128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2320 -ip 2320
1⤵
PID:1848

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\javaw.exe
Filesize
389KB

MD5
5187f0ae3fc7ecd5b247cd1414c38400

SHA1
36f96baef19fe58e3ce8b11638ff080658cd4390

SHA256
667c10a7b4f2f2804e25c238318f9b1861c968950bda3c13245570ad06c44bda

SHA512
4bbdbf59ed4000b04ee4519b18cf78c4affa4b226168deb4041fa4a06ae205d95189b4a26baa97a4941fa388c0c5ac8ec95dc3645949032b71460e9f5aa6d0be

Download Submit
memory/900-5-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/900-12-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/900-4-0x0000000004F60000-0x0000000004FF2000-memory.dmp

Filesize
584KB

Download
memory/900-0-0x000000007483E000-0x000000007483F000-memory.dmp

Filesize
4KB

Download
memory/900-6-0x0000000004EA0000-0x0000000004EAA000-memory.dmp

Filesize
40KB

Download
memory/900-7-0x0000000004EE0000-0x0000000004EEE000-memory.dmp

Filesize
56KB

Download
memory/900-8-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/900-3-0x0000000005470000-0x0000000005A14000-memory.dmp

Filesize
5.6MB

Download
memory/900-2-0x0000000004E00000-0x0000000004E30000-memory.dmp

Filesize
192KB

Download
memory/900-1-0x0000000000590000-0x00000000005F8000-memory.dmp

Filesize
416KB

Download
memory/2320-27-0x0000000000390000-0x00000000003BC000-memory.dmp

Filesize
176KB

Download
memory/2320-24-0x0000000000390000-0x00000000003BC000-memory.dmp

Filesize
176KB

Download
memory/2320-31-0x0000000000390000-0x00000000003BC000-memory.dmp

Filesize
176KB

Download
memory/4196-32-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/4196-20-0x0000000005DD0000-0x0000000005E6C000-memory.dmp

Filesize
624KB

Download
memory/4196-19-0x0000000005560000-0x000000000556A000-memory.dmp

Filesize
40KB

Download
memory/4196-18-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/4196-16-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/4196-17-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads