netwire | dfedae8d3b13ad57c1ce0abcccc3578c411e890fde8c118c64aa7b1564aeead4

General

Target

7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
Size

1.1MB
MD5

7e325204fdaa3d9a4be3facd66a01bf9
SHA1

72ae942dbdd61ab7256bac03a71c2f6488c4f381
SHA256

dfedae8d3b13ad57c1ce0abcccc3578c411e890fde8c118c64aa7b1564aeead4
SHA512

e91f5a3a8fd3e6800454eeba81c6489c3097d00f18e3126c036307f0d6909e91e618d26340fcadf4c7fc61a632f9fede8a8573f6712a3ad0f4d85b28ee834865
SSDEEP

24576:yAHnh+eWsN3skA4RV1Hom2KXMmHaCfIGCImN5:1h+ZkldoPK8YaCy

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

checklewis.ddns.net:3361

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
qbpWIrEm
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/1996-1-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/1996-10-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url	Host.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
3180	Host.exe
2728	Host.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0006000000022ad6-13.dat	autoit_exe
behavioral2/files/0x000b000000023442-34.dat	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4736 set thread context of 1996	4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe	86
PID 3180 set thread context of 2728	3180	Host.exe	88

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
3180	Host.exe
3180	Host.exe
3180	Host.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
3180	Host.exe
3180	Host.exe
3180	Host.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 1996	4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe	86
PID 4736 wrote to memory of 1996	4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe	86
PID 4736 wrote to memory of 1996	4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe	86
PID 4736 wrote to memory of 1996	4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe	86
PID 4736 wrote to memory of 1996	4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe	86
PID 1996 wrote to memory of 3180	1996	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe	87
PID 1996 wrote to memory of 3180	1996	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe	87
PID 1996 wrote to memory of 3180	1996	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe	87
PID 3180 wrote to memory of 2728	3180	Host.exe	88
PID 3180 wrote to memory of 2728	3180	Host.exe	88
PID 3180 wrote to memory of 2728	3180	Host.exe	88
PID 3180 wrote to memory of 2728	3180	Host.exe	88
PID 3180 wrote to memory of 2728	3180	Host.exe	88

C:\Users\Admin\AppData\Local\Temp\7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Users\Admin\AppData\Roaming\Install\Host.exe
    "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3180
  - - C:\Users\Admin\AppData\Roaming\Install\Host.exe
      "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
      4⤵
      Executes dropped EXE
      PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.exe

Filesize
1.1MB

MD5
f8d555e744670a1130c4ed09b091552a

SHA1
b557a0c8d3115da5c5fe435f07aa4362fa2729c3

SHA256
e65c486659347a2755e69271a6d97f277011a74332ab30760be8b9d0a654f95f

SHA512
c062f571a58093c16330d8a09ce4a6776ccc96c79211030b0aa3a74a32780ac73c4075f1332df86370ec981ee674bee5d01208ca4c556119293b8de82f24ae59

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
1.1MB

MD5
7e325204fdaa3d9a4be3facd66a01bf9

SHA1
72ae942dbdd61ab7256bac03a71c2f6488c4f381

SHA256
dfedae8d3b13ad57c1ce0abcccc3578c411e890fde8c118c64aa7b1564aeead4

SHA512
e91f5a3a8fd3e6800454eeba81c6489c3097d00f18e3126c036307f0d6909e91e618d26340fcadf4c7fc61a632f9fede8a8573f6712a3ad0f4d85b28ee834865

Download Submit
memory/1996-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1996-10-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4736-0-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing