netwire | d7d2907883adb90ded1abc61d1e7837fb422b8a1f316e69ab43ae322126898e2

General

Target

e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe
Size

493KB
MD5

e5868d20318b2068ff916241d36d8f2b
SHA1

e5a79616e85351555e13adc3d104844bb0f94106
SHA256

d7d2907883adb90ded1abc61d1e7837fb422b8a1f316e69ab43ae322126898e2
SHA512

4dc61bec51385d539749ec9b3e40751003775cf41a9453dac96702b230de84e245da56bb715401b64ef73da1bd1c02a1ca5249c9f067437444e2e16575efa103
SSDEEP

3072:+PL7/B2pA70HqL9IUoWmdI/vRCnB7T38pCDw7o876fy0s5yth3024xMjgv:+PLYpvg9IN2CB7TMpCDwUOv0s5Ok

Score

10^/10

netwire botnet discovery persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

62.102.148.181:57980

213.152.162.99:3829

109.163.226.153:3829

95.211.229.148:3939

31.171.155.48:3444

176.107.177.110:3444

Attributes

activex_autorun
true
activex_key
{H7PS4463-146B-40WE-68J6-5074Y040VWP6}
copy_executable
true
delete_original
true
host_id
~June2016~%Rand%
install_path
%AppData%\Microsoft\RegistryKey.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
dAfEhCrj
offline_keylogger
true
password
44eab7d73777
registry_autorun
true
startup_name
Microsoft
use_mutex
true

Signatures

NetWire RAT payload 5 IoCs

rat

resource	yara_rule
behavioral2/memory/4104-3-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/4104-6-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/4104-8-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/4176-23-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/4176-25-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H7PS4463-146B-40WE-68J6-5074Y040VWP6}	RegistryKey.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H7PS4463-146B-40WE-68J6-5074Y040VWP6}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegistryKey.exe\""	RegistryKey.exe

Executes dropped EXE 2 IoCs

pid	Process
5028	RegistryKey.exe
4176	RegistryKey.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegistryKey.exe"	RegistryKey.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1676 set thread context of 4104	1676	e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe	82
PID 5028 set thread context of 4176	5028	RegistryKey.exe	84

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegistryKey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegistryKey.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1676	e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe
Token: SeDebugPrivilege	5028	RegistryKey.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 4104	1676	e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe	82
PID 1676 wrote to memory of 4104	1676	e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe	82
PID 1676 wrote to memory of 4104	1676	e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe	82
PID 1676 wrote to memory of 4104	1676	e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe	82
PID 1676 wrote to memory of 4104	1676	e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe	82
PID 1676 wrote to memory of 4104	1676	e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe	82
PID 1676 wrote to memory of 4104	1676	e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe	82
PID 1676 wrote to memory of 4104	1676	e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe	82
PID 1676 wrote to memory of 4104	1676	e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe	82
PID 4104 wrote to memory of 5028	4104	e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe	83
PID 4104 wrote to memory of 5028	4104	e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe	83
PID 4104 wrote to memory of 5028	4104	e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe	83
PID 5028 wrote to memory of 4176	5028	RegistryKey.exe	84
PID 5028 wrote to memory of 4176	5028	RegistryKey.exe	84
PID 5028 wrote to memory of 4176	5028	RegistryKey.exe	84
PID 5028 wrote to memory of 4176	5028	RegistryKey.exe	84
PID 5028 wrote to memory of 4176	5028	RegistryKey.exe	84
PID 5028 wrote to memory of 4176	5028	RegistryKey.exe	84
PID 5028 wrote to memory of 4176	5028	RegistryKey.exe	84
PID 5028 wrote to memory of 4176	5028	RegistryKey.exe	84
PID 5028 wrote to memory of 4176	5028	RegistryKey.exe	84

C:\Users\Admin\AppData\Local\Temp\e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Users\Admin\AppData\Roaming\Microsoft\RegistryKey.exe
    -m "C:\Users\Admin\AppData\Local\Temp\e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Users\Admin\AppData\Roaming\Microsoft\RegistryKey.exe
      C:\Users\Admin\AppData\Local\Temp\e5868d20318b2068ff916241d36d8f2b_JaffaCakes118.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:4176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\RegistryKey.exe

Filesize
493KB

MD5
e5868d20318b2068ff916241d36d8f2b

SHA1
e5a79616e85351555e13adc3d104844bb0f94106

SHA256
d7d2907883adb90ded1abc61d1e7837fb422b8a1f316e69ab43ae322126898e2

SHA512
4dc61bec51385d539749ec9b3e40751003775cf41a9453dac96702b230de84e245da56bb715401b64ef73da1bd1c02a1ca5249c9f067437444e2e16575efa103

Download Submit
memory/1676-1-0x0000000074A60000-0x0000000075011000-memory.dmp

Filesize
5.7MB

Download
memory/1676-2-0x0000000074A60000-0x0000000075011000-memory.dmp

Filesize
5.7MB

Download
memory/1676-0-0x0000000074A62000-0x0000000074A63000-memory.dmp

Filesize
4KB

Download
memory/1676-12-0x0000000074A60000-0x0000000075011000-memory.dmp

Filesize
5.7MB

Download
memory/4104-3-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4104-8-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4104-6-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4176-23-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4176-25-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5028-14-0x0000000074A60000-0x0000000075011000-memory.dmp

Filesize
5.7MB

Download
memory/5028-13-0x0000000074A62000-0x0000000074A63000-memory.dmp

Filesize
4KB

Download
memory/5028-15-0x0000000074A60000-0x0000000075011000-memory.dmp

Filesize
5.7MB

Download
memory/5028-24-0x0000000074A60000-0x0000000075011000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads