Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

5d0b535797...18.exe

windows7-x64

10

5d0b535797...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5d0b535797bcd3fd8b482e250e339aa6_JaffaCakes118

  • Size

    260KB

  • Sample

    240520-ee672aba9v

  • MD5

    5d0b535797bcd3fd8b482e250e339aa6

  • SHA1

    71d95bf3290b7f39498cd20fb983feb46f6a6d5c

  • SHA256

    30a798f90d068468a49bda1cf1dc25d8a89b6ff3acdcf3715f852bf5aba48d7f

  • SHA512

    ab297abcfcc8a85d59dcd749ea0eeee8ea6f8e47a78a2c99ef70f1691385109981b587dbad44391ca3fbea0a36d117c1bc2aa408475e5ef741fb8e5461075392

  • SSDEEP

    6144:zgTXabnD9sKIuXm968jhvz/+gt0EF6E1i:ziWnD9sxtjhz+gj

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Extracted

Family

netwire

C2

109.202.103.170:8733

213.152.161.229:8733

109.202.107.10:8733

213.152.162.15:8733

213.152.161.239:8733
Attributes
  • activex_autorun

    true

  • activex_key

    {B1R4X6Q6-38AJ-P6L0-Y740-01J2YA7AKCK3}

  • copy_executable

    true

  • delete_original

    true

  • host_id

    07.2019

  • install_path

    %AppData%\Install\Host.exe

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    true

  • mutex

    oDEDWxKJ

  • offline_keylogger

    true

  • password

    DAWAJ$$$pesos666

  • registry_autorun

    true

  • startup_name

    system

  • use_mutex

    true

Targets

    • Target

      5d0b535797bcd3fd8b482e250e339aa6_JaffaCakes118

    • Size

      260KB

    • MD5

      5d0b535797bcd3fd8b482e250e339aa6

    • SHA1

      71d95bf3290b7f39498cd20fb983feb46f6a6d5c

    • SHA256

      30a798f90d068468a49bda1cf1dc25d8a89b6ff3acdcf3715f852bf5aba48d7f

    • SHA512

      ab297abcfcc8a85d59dcd749ea0eeee8ea6f8e47a78a2c99ef70f1691385109981b587dbad44391ca3fbea0a36d117c1bc2aa408475e5ef741fb8e5461075392

    • SSDEEP

      6144:zgTXabnD9sKIuXm968jhvz/+gt0EF6E1i:ziWnD9sxtjhz+gj

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks