Overview

overview

10

Static

static

3

Proof of payment.exe

windows7-x64

10

Proof of payment.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e834f3579bb9aa88dd9bad15e964bf89_JaffaCakes118

  • Size

    891KB

  • Sample

    240918-dk835szarg

  • MD5

    e834f3579bb9aa88dd9bad15e964bf89

  • SHA1

    9c8254d6e45e0b9dc4d0b672ef9aabb5ee53c925

  • SHA256

    c424f3d9cd1b47e23678c1d0d02cf9b4befbacf8ba63491019b28d5abcbaf0ee

  • SHA512

    dab6646bdfc266638fa62318b9b765a8f2de93509f0b900e463d1bd4f104776b821200e343c155cb74d3ba846ee1eb015f803134811da00f7905697b81fc5ee9

  • SSDEEP

    24576:eH9vvaLdMTNHJcYXPHGDzsdEodx7o39FQYcgHE8:K9vvIMlXEmxU96s

Score
10/10
netwirebotnetdiscoverypersistenceratstealer

Malware Config

Extracted

Family

netwire

C2

185.140.53.220:3363

185.140.53.220:3369
Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    NETHERLAND

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      Proof of payment.exe

    • Size

      1006KB

    • MD5

      7e1d18de24aeff3df526dc7ab6ff05dc

    • SHA1

      49f9323be153edc7d4467aa3280f9afc3d6b1533

    • SHA256

      629333f4adba87b2412a8c8fa301a25042de764506ea1f369b38fa10c6112547

    • SHA512

      999e7c19a26fe755132bba012884410d9a181beaa476aade615f3961e2ca911de988d35d04a196ee76748469ac1a0b1c0330d0a7728d574318872766c364449e

    • SSDEEP

      24576:6NA3R5drXdtBeHJePXzHbuzBux7s3oFQYcEn7W:z5bEaxIo6V

    Score
    10/10
    netwirebotnetdiscoverypersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks