netwire | 5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5

General

Target

bdd639e15d8c88efe5ab1f58608a0302_JaffaCakes118.exe
Size

562KB
MD5

bdd639e15d8c88efe5ab1f58608a0302
SHA1

fd99f0cff3ebbc6254c86147096148b41aa31b5f
SHA256

5283ee93c25e567f42c1dd8743e1121a6973f922d1ef6e9286b3d40e27f357b5
SHA512

880f7f2401a470c4c157659cec8b3f396233b260a1cc68d698cb0443e88bef56ddf2435e100a1c780956b5cbe5c22906024ef4a90245d1615ebf28fd67efdd85
SSDEEP

12288:V8FaD+mjs28sVj4tOSlI3XopCZET0Ri+esTCmmZ:QaD+mgGj4tlQX1Zq0x2my

Score

10^/10

netwire bootkit botnet discovery persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

127.0.0.1:3360

elumadns.eluma101.com:4003

elumadns.eluma101.com:4000

jmoney.daniel2you.com:4000

jmoney.daniel2you.com:4003

oluwa101.hopto.org:4003

oluwa101.hopto.org:4000

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
NEWEST_2019
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
BEBSWoHf
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2420-37-0x0000000000400000-0x000000000042D000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Executes dropped EXE 1 IoCs

pid	Process
2328	Host.exe

Loads dropped DLL 1 IoCs

pid	Process
2420	mstsc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ms OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Macromedia\\StikyNot.exe"	bdd639e15d8c88efe5ab1f58608a0302_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	mstsc.exe
File opened (read-only)	\??\M:	mstsc.exe
File opened (read-only)	\??\O:	mstsc.exe
File opened (read-only)	\??\P:	mstsc.exe
File opened (read-only)	\??\Q:	mstsc.exe
File opened (read-only)	\??\V:	mstsc.exe
File opened (read-only)	\??\Z:	mstsc.exe
File opened (read-only)	\??\G:	mstsc.exe
File opened (read-only)	\??\E:	mstsc.exe
File opened (read-only)	\??\J:	mstsc.exe
File opened (read-only)	\??\L:	mstsc.exe
File opened (read-only)	\??\R:	mstsc.exe
File opened (read-only)	\??\X:	mstsc.exe
File opened (read-only)	\??\Y:	mstsc.exe
File opened (read-only)	\??\B:	mstsc.exe
File opened (read-only)	\??\I:	mstsc.exe
File opened (read-only)	\??\W:	mstsc.exe
File opened (read-only)	\??\H:	mstsc.exe
File opened (read-only)	\??\N:	mstsc.exe
File opened (read-only)	\??\S:	mstsc.exe
File opened (read-only)	\??\T:	mstsc.exe
File opened (read-only)	\??\U:	mstsc.exe
File opened (read-only)	\??\A:	mstsc.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	bdd639e15d8c88efe5ab1f58608a0302_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2292 set thread context of 2420	2292	bdd639e15d8c88efe5ab1f58608a0302_JaffaCakes118.exe	30

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bdd639e15d8c88efe5ab1f58608a0302_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mstsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Host.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2128	mstsc.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2420	2292	bdd639e15d8c88efe5ab1f58608a0302_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2420	2292	bdd639e15d8c88efe5ab1f58608a0302_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2420	2292	bdd639e15d8c88efe5ab1f58608a0302_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2420	2292	bdd639e15d8c88efe5ab1f58608a0302_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2420	2292	bdd639e15d8c88efe5ab1f58608a0302_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2420	2292	bdd639e15d8c88efe5ab1f58608a0302_JaffaCakes118.exe	30
PID 2420 wrote to memory of 2328	2420	mstsc.exe	31
PID 2420 wrote to memory of 2328	2420	mstsc.exe	31
PID 2420 wrote to memory of 2328	2420	mstsc.exe	31
PID 2420 wrote to memory of 2328	2420	mstsc.exe	31
PID 2328 wrote to memory of 2128	2328	Host.exe	32
PID 2328 wrote to memory of 2128	2328	Host.exe	32
PID 2328 wrote to memory of 2128	2328	Host.exe	32
PID 2328 wrote to memory of 2128	2328	Host.exe	32

C:\Users\Admin\AppData\Local\Temp\bdd639e15d8c88efe5ab1f58608a0302_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bdd639e15d8c88efe5ab1f58608a0302_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\System32\mstsc.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Users\Admin\AppData\Roaming\Install\Host.exe
    "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Windows\system32\mstsc.exe
      "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
      4⤵
      Enumerates connected drives
      Suspicious behavior: GetForegroundWindowSpam
      PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
1.0MB

MD5
68b4a549d0b56a4dd9a488751037cf09

SHA1
fa7137a8cd430ffeb9e869443026dcde540dbcc2

SHA256
a9286688556dbb45303d3a0e7825294f58ffd48e125518ac33ab009426c967cc

SHA512
569c29845e7a82fdc9b2a483175a1674f67a553d23f61057c87d07598ba55fc1a1ad96343409b50d537886ee58b3e849d9d3b0dc8ada7f15e3de2a6a5e3fd66a

Download Submit
memory/2292-9-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2292-12-0x0000000000610000-0x0000000000612000-memory.dmp

Filesize
8KB

Download
memory/2292-6-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2292-19-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/2292-20-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2292-18-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/2292-17-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/2292-16-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2292-15-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2292-14-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/2292-13-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2292-11-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2292-10-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2292-0-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/2292-7-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2292-4-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2292-5-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2292-8-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2292-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2292-2-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2292-21-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/2292-22-0x0000000000270000-0x00000000002B2000-memory.dmp

Filesize
264KB

Download
memory/2292-23-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/2292-1-0x0000000000270000-0x00000000002B2000-memory.dmp

Filesize
264KB

Download
memory/2292-35-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/2420-28-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2420-37-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2420-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2420-32-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2420-36-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads