Overview

overview

10

Static

static

3

af79eb8a77...18.exe

windows7-x64

10

af79eb8a77...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-06-2024 17:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    af79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exe

  • Size

    392KB

  • MD5

    af79eb8a77c46f99d2a80841353679d2

  • SHA1

    d07a388f144864a69d3b1fb9f6b83a5a9fc01b4d

  • SHA256

    a7374e3645615c6c1c7326ccdab9c6743ed71723397524a15b1548d2c1a24a15

  • SHA512

    aa88e883bf3f1c1387283e0e68b40cf13e55501c328ac26efa663c943d9b9bf6f8f0e0d5a8162783feadde3d2e4f7279d6a327ba9c2dc2e77c05042e42e5e3c4

  • SSDEEP

    6144:fNXqRB78GUgn+DTCcfBLy+SnpsuXBKnVN0tYyvrn:VXqr78GU8G98RKVGr

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

wealthyman.brasilia.me:39560

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    WEALTH

  • keylogger_dir

    %AppData%\music\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    sucess

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 1 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\af79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\af79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:332
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN "Minters4" /TR "C:\Users\Admin\AppData\Local\Temp\Bantamvgteren.exe"
      2⤵
      • Creates scheduled task(s)
      PID:5004
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /run /tn "Minters4"
      2⤵
        PID:4308
    • C:\Users\Admin\AppData\Local\Temp\Bantamvgteren.exe
      C:\Users\Admin\AppData\Local\Temp\Bantamvgteren.exe
      1⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      PID:3780
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:4428

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Bantamvgteren.exe
        Filesize

        392KB

        MD5

        cd2bd627123db0ea0c2bbb428e830bfb

        SHA1

        3cc80c258bb30b2ad4815427ec57b7a19ba2cc00

        SHA256

        480310f5e5d0605c22a5cf739559a6f2176220b0df7a488ae1753ca33e186a46

        SHA512

        e4ac28d670eb47733e1368dc1b8b8864943e552bd17bc682bd56920c21e218264f555f3833f1e9733cf706b45ac26e7d7c9280b50136e9facf25bc5340bcb1a2

        Download Submit

      • memory/332-8947-0x00000000779A1000-0x0000000077AC1000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/3780-17900-0x0000000000400000-0x000000000042C000-memory.dmp

        Filesize

        176KB

        Download

      • memory/3780-17906-0x0000000075660000-0x0000000075780000-memory.dmp

        Filesize

        1.1MB

        Download