Overview

overview

10

Static

static

3

126a93893a...18.exe

windows7-x64

10

126a93893a...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    26-06-2024 15:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    126a93893a231d0d04d51c062ffacb24_JaffaCakes118.exe

  • Size

    620KB

  • MD5

    126a93893a231d0d04d51c062ffacb24

  • SHA1

    2dc7626161923496e1161321564649de8a505462

  • SHA256

    8119fc6da4305f331fc904adfca9e221d26bd607a53e35dbeede7e379b051f20

  • SHA512

    7ead5d82543478d48820429fa78a6b47c4b96f9a081d6599bc7f47208acc73dee20b97345f971b7298642fb4104d90eb8a660cbdc8f592449410cba459d46715

  • SSDEEP

    6144:jIgLd7M38csN+OepKstohqNuPSzjRfXfqSicv2oJ04YIEr7rwdaJ:JNMJzpWhYvRfXiSicbJ0d7rco

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Extracted

Family

netwire

C2

Wealthybond.ddns.me:39560

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    uElWAoFe

  • offline_keylogger

    true

  • password

    sucess

  • registry_autorun

    false

  • use_mutex

    true

Signatures

  • NetWire RAT payload 1 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\126a93893a231d0d04d51c062ffacb24_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\126a93893a231d0d04d51c062ffacb24_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Users\Admin\AppData\Local\Temp\126a93893a231d0d04d51c062ffacb24_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\126a93893a231d0d04d51c062ffacb24_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2148
      • C:\Users\Admin\AppData\Local\Temp\Elektroteknikkerne3.exe
        "C:\Users\Admin\AppData\Local\Temp\Elektroteknikkerne3.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2132
        • C:\Users\Admin\AppData\Local\Temp\Elektroteknikkerne3.exe
          "C:\Users\Admin\AppData\Local\Temp\Elektroteknikkerne3.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2596

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\win.ini
    Filesize

    509B

    MD5

    d2a2412bddba16d60ec63bd9550d933f

    SHA1

    deb3d3bdc9055f0b4909b31d3048446848fae0e1

    SHA256

    79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a

    SHA512

    8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

    Download Submit

  • \Users\Admin\AppData\Local\Temp\Elektroteknikkerne3.exe
    Filesize

    620KB

    MD5

    c8b740d5083715048f6ec93a3fdc627c

    SHA1

    754919550bdd0d8c911e2a8f064a474d0cdeb457

    SHA256

    7cc46b7baca763d9a1ec051befb75e5d2e6e30aeffd76613d149e6ccb6f9e42b

    SHA512

    9ca26f1f9f716320792804152eda11c17f85f55fbb02fea7f074415d72c87795dbb34ecc3944042f1597c5c64b3da4c19f30c123d24d9ddee01c772f5d2d366e

    Download Submit

  • memory/2148-13-0x0000000077070000-0x0000000077219000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/2148-24-0x0000000077070000-0x0000000077219000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/2344-3-0x0000000002720000-0x0000000002820000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2344-7-0x0000000077070000-0x0000000077219000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/2344-6-0x0000000077071000-0x0000000077172000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/2344-12-0x0000000077260000-0x0000000077336000-memory.dmp

    Filesize

    856KB

    Download

  • memory/2596-34-0x0000000000400000-0x000000000049D000-memory.dmp

    Filesize

    628KB

    Download