netwire

General

Target

fe1a21fd2f2c7385f70ed907ea985707_JaffaCakes118
Size

110KB
Sample

240929-jxxtjavgrr
MD5

fe1a21fd2f2c7385f70ed907ea985707
SHA1

30abfcfb656f8dfa304aa40c328bd879e532483a
SHA256

f338a70e47e02ffe040eb7d23a3d15ecdb6252412f786c95bad31c0c51f7d2a8
SHA512

6f55edda96d10d63eba9b1c0ca03f02f74af555e0731fe7b03e5b534ffa5f14654076b5e69bff775281569eef01874dd300c0e9943129617307688c0112bae48
SSDEEP

3072:/i51oD+WU38f5wrEI1cAXBgQRCh+dawWh4eIqfV:6/ojO83I1UEChu1WCejt

Score

10^/10

Malware Config

Extracted

Family

netwire

C2

127.0.0.1:1533

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
spaxxxvbn
lock_executable
false
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
false

Targets

- Target
  
  sparrows.exe
- Size
  
  208KB
- MD5
  
  0b7621da72f30a6ce13f51de02bfd098
- SHA1
  
  68c7dc41b82713067c4fde4455339d84e2c39e66
- SHA256
  
  2e27bf386a514320dc15a2cbce4967a1cb7602dbc2e90865dc19d422776e8063
- SHA512
  
  cc9c208c1bfca3ccb6ba6466072414787b9105d13e90d7dcfea0d61de394751c9d9c5f0d9f4d385c98240c188dcd67044d22a3033afc05e5970f2df43bd3ea65
- SSDEEP
  
  3072:bNFviD+WU38n5wrEY13Mz1eGbbrdgMTXOM7B+p:JspO8vY13FGXxge4p
Score

10^/10

netwire botnet discovery rat stealer
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

NetWire RAT payload

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2