netwire | 76947dcfe886fe0e3273c7723140533999741f239a2ad7568a460cae74bb0e50

General

Target

edfa9ff3c8d0154beb501a347c0642a0_JaffaCakes118.exe
Size

212KB
MD5

edfa9ff3c8d0154beb501a347c0642a0
SHA1

afd2ff183a07e9d41e2d58a586e00b9fd1d2b400
SHA256

76947dcfe886fe0e3273c7723140533999741f239a2ad7568a460cae74bb0e50
SHA512

6628fd737b0bf3b2c6e4f4140ec489609044c6365320c2035b7817668bf9f19d37ce8b5baa9b932dbfac8a4a3f66b51920802ecab68a9a1e436b22599a0aa056
SSDEEP

6144:oqjIQQQfyk92EJKBJrWY5BCGU/7r0SH0R5gTC/X2sL6wut:lzQ8v9XKBxWY5BCpDr0SUjgm/msL6wO

Score

10^/10

netwire botnet discovery rat stealer

Malware Config

Extracted

Family

netwire

C2

jahblessrtd4ever.home-webserver.de:2797

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
ToBfxbDi
offline_keylogger
true
password
Gog205!@#
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/764-13-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/764-16-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/764-17-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/764-18-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Loads dropped DLL 2 IoCs

pid	Process
2264	edfa9ff3c8d0154beb501a347c0642a0_JaffaCakes118.exe
2264	edfa9ff3c8d0154beb501a347c0642a0_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2264 set thread context of 764	2264	edfa9ff3c8d0154beb501a347c0642a0_JaffaCakes118.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edfa9ff3c8d0154beb501a347c0642a0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edfa9ff3c8d0154beb501a347c0642a0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2264	edfa9ff3c8d0154beb501a347c0642a0_JaffaCakes118.exe
2264	edfa9ff3c8d0154beb501a347c0642a0_JaffaCakes118.exe
2264	edfa9ff3c8d0154beb501a347c0642a0_JaffaCakes118.exe
2264	edfa9ff3c8d0154beb501a347c0642a0_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2264	edfa9ff3c8d0154beb501a347c0642a0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 764	2264	edfa9ff3c8d0154beb501a347c0642a0_JaffaCakes118.exe	30
PID 2264 wrote to memory of 764	2264	edfa9ff3c8d0154beb501a347c0642a0_JaffaCakes118.exe	30
PID 2264 wrote to memory of 764	2264	edfa9ff3c8d0154beb501a347c0642a0_JaffaCakes118.exe	30
PID 2264 wrote to memory of 764	2264	edfa9ff3c8d0154beb501a347c0642a0_JaffaCakes118.exe	30
PID 2264 wrote to memory of 764	2264	edfa9ff3c8d0154beb501a347c0642a0_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\edfa9ff3c8d0154beb501a347c0642a0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\edfa9ff3c8d0154beb501a347c0642a0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Users\Admin\AppData\Local\Temp\edfa9ff3c8d0154beb501a347c0642a0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\edfa9ff3c8d0154beb501a347c0642a0_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fjjogisu.dll

Filesize
11KB

MD5
28a4ec52713fbb4c81bf69d41b48f5c9

SHA1
aeb12c12868a621d77593da2f05f1ffd85c95966

SHA256
085928c36e78eef2ed36ac7cd321c66baf9e7f6c560ecefc5656da4a123864d5

SHA512
683a8e60b9b298ac00f6331ecb211fc3124170894a9fbad36b48b7a1bcde04b15912d4e52fffeb92fe55318b0ebcd322ac4cf1b83b740d32e8ba6bd5c4a08006

Download Submit
\Users\Admin\AppData\Local\Temp\nseA555.tmp\System.dll

Filesize
11KB

MD5
fccff8cb7a1067e23fd2e2b63971a8e1

SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91

SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

Download Submit
memory/764-13-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/764-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/764-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/764-18-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2264-12-0x00000000747D0000-0x00000000747D7000-memory.dmp

Filesize
28KB

Download
memory/2264-14-0x00000000747D0000-0x00000000747D7000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing