Overview

overview

10

Static

static

3

33dc22b4ef...18.exe

windows7-x64

10

33dc22b4ef...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    33dc22b4ef25fe6fee8a43e641c608f5_JaffaCakes118

  • Size

    1003KB

  • Sample

    241011-h66x5a1grc

  • MD5

    33dc22b4ef25fe6fee8a43e641c608f5

  • SHA1

    e148843d5cee93f9b50c15425c6b1b01af00973b

  • SHA256

    ba8ed49fd6348e63a8b6de28ffdf70f4267613b6e32a481d7528ff3f33016c7f

  • SHA512

    e1bcc25c4091b341926cc74bb764f7a9d6ba356cdd50d512e671b11c9c65354d6a070c7dea779f6bac6882cb4883855f08f4952b94ec9af1e7292344244d21ea

  • SSDEEP

    12288:7K2mhAMJ/cPlM/GuJhqPTFQNSSK81YBXcQOCLsn2lwnlZwL0ZApuA3bDtWSY:O2O/GlMVJ4PT2IEeOCLs2lQlZP69bY

Score
10/10
netwirebotnetdiscoverypersistenceratstealer

Malware Config

Extracted

Family

netwire

C2

194.68.59.66:3365

194.68.59.66:3367
Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Fuckyou1

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      33dc22b4ef25fe6fee8a43e641c608f5_JaffaCakes118

    • Size

      1003KB

    • MD5

      33dc22b4ef25fe6fee8a43e641c608f5

    • SHA1

      e148843d5cee93f9b50c15425c6b1b01af00973b

    • SHA256

      ba8ed49fd6348e63a8b6de28ffdf70f4267613b6e32a481d7528ff3f33016c7f

    • SHA512

      e1bcc25c4091b341926cc74bb764f7a9d6ba356cdd50d512e671b11c9c65354d6a070c7dea779f6bac6882cb4883855f08f4952b94ec9af1e7292344244d21ea

    • SSDEEP

      12288:7K2mhAMJ/cPlM/GuJhqPTFQNSSK81YBXcQOCLsn2lwnlZwL0ZApuA3bDtWSY:O2O/GlMVJ4PT2IEeOCLs2lQlZP69bY

    Score
    10/10
    netwirebotnetdiscoverypersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks