Overview

overview

10

Static

static

1

d97dc7068c...18.msi

windows7-x64

10

d97dc7068c...18.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d97dc7068c3264ec0ef8d228db33ef12_JaffaCakes118

  • Size

    300KB

  • Sample

    240911-dejlasyfnk

  • MD5

    d97dc7068c3264ec0ef8d228db33ef12

  • SHA1

    cc811a1ced21af00d47968f87f7c2a6198dffad7

  • SHA256

    2e60d3cd818fa132f8425b50f8a1de53fb7c1ebfa050bd3891a4f5c97971bf10

  • SHA512

    bde02f49f92a39a51ee683522201a83fb6651df424400a0a1b39c00aa74f5ab05dda60f75354467c8ef6c2b535c365dcd68dd86c93b51577afbf2a2fa5dd2be9

  • SSDEEP

    6144:2EAidq19l2sJmwh4HYRYtEWBzhlANcjat9w44mKZ:2E6N44RQEW54m+934zZ

Score
10/10
netwirebotnetdiscoverypersistenceprivilege_escalationratstealer

Malware Config

Extracted

Family

netwire

C2

wealthymachine.ddns.net:39560

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    sunshineslisa

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    sucess

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      d97dc7068c3264ec0ef8d228db33ef12_JaffaCakes118

    • Size

      300KB

    • MD5

      d97dc7068c3264ec0ef8d228db33ef12

    • SHA1

      cc811a1ced21af00d47968f87f7c2a6198dffad7

    • SHA256

      2e60d3cd818fa132f8425b50f8a1de53fb7c1ebfa050bd3891a4f5c97971bf10

    • SHA512

      bde02f49f92a39a51ee683522201a83fb6651df424400a0a1b39c00aa74f5ab05dda60f75354467c8ef6c2b535c365dcd68dd86c93b51577afbf2a2fa5dd2be9

    • SSDEEP

      6144:2EAidq19l2sJmwh4HYRYtEWBzhlANcjat9w44mKZ:2E6N44RQEW54m+934zZ

    Score
    10/10
    netwirebotnetdiscoverypersistenceprivilege_escalationratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Drops startup file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks