netwire | 282e441b58eed38ce5b5aeae04ad6d174ff23b8c7a6ced664c54b683f8cfc8ab

General

Target

66ae237c1680a6c0194d4a5ef883a146_JaffaCakes118.exe
Size

1.5MB
MD5

66ae237c1680a6c0194d4a5ef883a146
SHA1

7c37067d047caae8b5ca9127a6b89845e833c520
SHA256

282e441b58eed38ce5b5aeae04ad6d174ff23b8c7a6ced664c54b683f8cfc8ab
SHA512

894d8f621a240f99bf9914c2efe2205b61cedf16573a559020616e26dc47f8cdf9fc4f063ed8a1b46e6ca51baa4f5cda317d60aa3649f0af90abdbc88ddca5a0
SSDEEP

24576:AAOcZwdf+OD0+5PYjasPw5X1WelwB1rABQ8iHX0eFpPFbKi6FGxGIsDCabnd:ef5wja2ayfmgpPFbKi6kxxK1bnd

Score

10^/10

netwire botnet discovery persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

harold.ns01.info:3606

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
Netwir
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
pHJVBoFH
offline_keylogger
true
password
master12
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/3052-95-0x0000000000370000-0x0000000000889000-memory.dmp	netwire
behavioral1/memory/3052-94-0x0000000000370000-0x0000000000889000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Executes dropped EXE 1 IoCs

pid	Process
2936	lqilwl.pif

Loads dropped DLL 4 IoCs

pid	Process
2220	66ae237c1680a6c0194d4a5ef883a146_JaffaCakes118.exe
2220	66ae237c1680a6c0194d4a5ef883a146_JaffaCakes118.exe
2220	66ae237c1680a6c0194d4a5ef883a146_JaffaCakes118.exe
2220	66ae237c1680a6c0194d4a5ef883a146_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\40791675\\lqilwl.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\40791675\\wmrvmdcs.ije"	lqilwl.pif

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2936 set thread context of 3052	2936	lqilwl.pif	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66ae237c1680a6c0194d4a5ef883a146_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lqilwl.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	DllHost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2884	DllHost.exe
2884	DllHost.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2936	2220	66ae237c1680a6c0194d4a5ef883a146_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2936	2220	66ae237c1680a6c0194d4a5ef883a146_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2936	2220	66ae237c1680a6c0194d4a5ef883a146_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2936	2220	66ae237c1680a6c0194d4a5ef883a146_JaffaCakes118.exe	30
PID 2936 wrote to memory of 3052	2936	lqilwl.pif	31
PID 2936 wrote to memory of 3052	2936	lqilwl.pif	31
PID 2936 wrote to memory of 3052	2936	lqilwl.pif	31
PID 2936 wrote to memory of 3052	2936	lqilwl.pif	31
PID 2936 wrote to memory of 3052	2936	lqilwl.pif	31
PID 2936 wrote to memory of 3052	2936	lqilwl.pif	31
PID 2936 wrote to memory of 3052	2936	lqilwl.pif	31
PID 2936 wrote to memory of 3052	2936	lqilwl.pif	31
PID 2936 wrote to memory of 3052	2936	lqilwl.pif	31

C:\Users\Admin\AppData\Local\Temp\66ae237c1680a6c0194d4a5ef883a146_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\66ae237c1680a6c0194d4a5ef883a146_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\40791675\lqilwl.pif
  "C:\Users\Admin\AppData\Local\Temp\40791675\lqilwl.pif" wmrvmdcs.ije
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3052

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\40791675\Windovert POP Deposit.jpg

Filesize
307KB

MD5
b3b59bb99846e645f1cf4ffc3a70deb0

SHA1
9e8a9b321360465d3929194196308c422c1cad22

SHA256
4c85c5fdd12e47095e039943043ebd5caf4f09b1d4fa523525e36234a26279cf

SHA512
ca3d0d6f5ac5540e5d80d36972eb6f67f241b7aa47ac8e852d20a4f9c105c3b298e78a6cab2587309e5bf25e6c0c9d3077220046270e414e785249b75cf6f848

Download Submit
C:\Users\Admin\AppData\Local\Temp\40791675\mird.xml

Filesize
377KB

MD5
744295ad3e845c00badb2c4701521e8b

SHA1
039c5c54de34eb8a8fbb29d8ba0912d355e1293f

SHA256
b8cc7d152ee42023207babb9ea6511fea1565b7e5a4f43bbeb27d3f028c1e4c0

SHA512
1236d0dd7078064e7c4a1fe88e8696b53bef794fe754878c2d362a2ef418facbb5e386076912905ce611f6d12d9a95c0a20f4a8b699a3e412be5729a59f8362e

Download Submit
\Users\Admin\AppData\Local\Temp\40791675\lqilwl.pif

Filesize
649KB

MD5
e423fa6f72ef1a0d63ef5f85380657d6

SHA1
83114ec1db55867fde6d249352fcb3c52ef53af2

SHA256
4c38d6dc99e8219ccc923bddc94c9298f6b5aee6b4b42323d924cffdeafd356e

SHA512
687407a6354547f11faf190472e5fa5c50c0d01d911823b372d80029054e2e830c08b2a9100f5f1b1a742d0755bddfb784854bd7431f98b6b352010e2d01dac3

Download Submit
memory/2220-68-0x00000000023A0000-0x00000000023A2000-memory.dmp

Filesize
8KB

Download
memory/2884-69-0x00000000001A0000-0x00000000001A2000-memory.dmp

Filesize
8KB

Download
memory/2884-70-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2884-96-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/3052-91-0x0000000000370000-0x0000000000889000-memory.dmp

Filesize
5.1MB

Download
memory/3052-93-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3052-95-0x0000000000370000-0x0000000000889000-memory.dmp

Filesize
5.1MB

Download
memory/3052-94-0x0000000000370000-0x0000000000889000-memory.dmp

Filesize
5.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads