netwire | ee1a3b6747408c19a04a7bd69a4af9d81e71637a49ea16834e9e5ad381be4241

General

Target

81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe
Size

250KB
MD5

81e62e155aa60cb563f4abb72e2d7545
SHA1

64c7ff05b6043a53e3c5b32f9d1610c7a711b274
SHA256

ee1a3b6747408c19a04a7bd69a4af9d81e71637a49ea16834e9e5ad381be4241
SHA512

906352611c7dc7b8204ad91faacba3f89006245f6d6d739fe24dfcd2edf4e8c48323009f7fafb96ea072d0affaaa80ce78456b7d151a6b0d24514c04eba0ecba
SSDEEP

6144:q1BLCofs/ic8Uo1DeXggJYXRYhxhjuk618HMqWIpbsQO:oLCCsKsuUJY2GH8KUQx

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

mardjdf.ug:6974

kjsdtrfuyhgxcv.ru:6974

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Tlogs\
lock_executable
false
mutex
hgdGIATE
offline_keylogger
true
password
rdfs34df32sdf
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/2620-24-0x0000000000400000-0x000000000042B000-memory.dmp	netwire
behavioral1/memory/2620-25-0x0000000000400000-0x000000000042B000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kjhgcxvbe.vbs	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3020 set thread context of 2620	3020	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3020	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe
3020	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe
3020	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe
3020	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3020	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2620	3020	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe	28
PID 3020 wrote to memory of 2620	3020	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe	28
PID 3020 wrote to memory of 2620	3020	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe	28
PID 3020 wrote to memory of 2620	3020	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe	28
PID 3020 wrote to memory of 2620	3020	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe"
  2⤵
  PID:2620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2620-24-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2620-25-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3020-16-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-13-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-11-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-21-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-20-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-19-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-18-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-17-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-1-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/3020-15-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-14-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-4-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-12-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-10-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-9-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-8-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-7-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-6-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-5-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-3-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/3020-2-0x00000000000F0000-0x00000000000F5000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing