netwire | d05b01de0d1bd816e1024cb47ba0b5c2205cc3aa274e466d59a39052ad945c36

General

Target

c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe
Size

540KB
MD5

c43f9a6bbb9ae4e618d4a72c626259d4
SHA1

b0d56df59de23d693e9d2bcfde5569c683895715
SHA256

d05b01de0d1bd816e1024cb47ba0b5c2205cc3aa274e466d59a39052ad945c36
SHA512

9b237dbcb32e0e5cba0d15c954c6bd830cee42d0235083a3d6dff49e6b25968ae797006fe432a264ee59b3e2139b0b40fd6479dfb14c2912df1cf91abb3a6fb6
SSDEEP

3072:lYFzyxPM+ETS8wwyd+Z9vZ9hiCeZI9rliT/qyqms1XIfnEL08kRk60RjH:lYJyxPML/OwFhiu9rlqa71MEL0P7uj

Score

10^/10

netwire botnet discovery rat stealer

Malware Config

Extracted

Family

netwire

C2

cowboyz.climatechangeawareness.uk:31256

Attributes

activex_autorun
true
activex_key
{3BGD0153-4IDF-FT00-RY63-XFA4O7NRPM6W}
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
pbNlVBON
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/2352-6-0x0000000000400000-0x000000000042B000-memory.dmp	netwire
behavioral2/memory/2352-13-0x0000000000400000-0x000000000042B000-memory.dmp	netwire
behavioral2/memory/2352-11-0x0000000000400000-0x000000000042B000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 564 set thread context of 2352	564	c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe	85
PID 564 set thread context of 2996	564	c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe	84

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3260	2352	WerFault.exe	85
3236	2996	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
564	c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe
564	c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 2996	564	c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe	84
PID 564 wrote to memory of 2996	564	c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe	84
PID 564 wrote to memory of 2996	564	c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe	84
PID 564 wrote to memory of 2352	564	c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe	85
PID 564 wrote to memory of 2352	564	c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe	85
PID 564 wrote to memory of 2352	564	c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe	85
PID 564 wrote to memory of 2996	564	c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe	84
PID 564 wrote to memory of 2352	564	c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c43f9a6bbb9ae4e618d4a72c626259d4_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 580
    3⤵
    - Program crash
    PID:3236
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 580
    3⤵
    - Program crash
    PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2352 -ip 2352
1⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2996 -ip 2996
1⤵
PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/564-0-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

Filesize
4KB

Download
memory/564-1-0x0000000000A10000-0x0000000000A9C000-memory.dmp

Filesize
560KB

Download
memory/564-2-0x0000000002E30000-0x0000000002E38000-memory.dmp

Filesize
32KB

Download
memory/564-3-0x0000000005420000-0x00000000054B2000-memory.dmp

Filesize
584KB

Download
memory/564-4-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/564-5-0x0000000005860000-0x0000000005890000-memory.dmp

Filesize
192KB

Download
memory/564-18-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/564-17-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/2352-6-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2352-13-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2352-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing