netwire | 282e441b58eed38ce5b5aeae04ad6d174ff23b8c7a6ced664c54b683f8cfc8ab

General

Target

66ae237c1680a6c0194d4a5ef883a146_JaffaCakes118.exe
Size

1.5MB
MD5

66ae237c1680a6c0194d4a5ef883a146
SHA1

7c37067d047caae8b5ca9127a6b89845e833c520
SHA256

282e441b58eed38ce5b5aeae04ad6d174ff23b8c7a6ced664c54b683f8cfc8ab
SHA512

894d8f621a240f99bf9914c2efe2205b61cedf16573a559020616e26dc47f8cdf9fc4f063ed8a1b46e6ca51baa4f5cda317d60aa3649f0af90abdbc88ddca5a0
SSDEEP

24576:AAOcZwdf+OD0+5PYjasPw5X1WelwB1rABQ8iHX0eFpPFbKi6FGxGIsDCabnd:ef5wja2ayfmgpPFbKi6kxxK1bnd

Score

10^/10

netwire botnet discovery persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

harold.ns01.info:3606

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
Netwir
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
pHJVBoFH
offline_keylogger
true
password
master12
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/4432-78-0x0000000000D00000-0x0000000001209000-memory.dmp	netwire
behavioral2/memory/4432-80-0x0000000000D00000-0x0000000001209000-memory.dmp	netwire
behavioral2/memory/4432-81-0x0000000000D00000-0x0000000001209000-memory.dmp	netwire
behavioral2/memory/4432-82-0x0000000000D00000-0x0000000001209000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	66ae237c1680a6c0194d4a5ef883a146_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3244	lqilwl.pif

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\40791675\\lqilwl.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\40791675\\wmrvmdcs.ije"	lqilwl.pif

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3244 set thread context of 4432	3244	lqilwl.pif	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66ae237c1680a6c0194d4a5ef883a146_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lqilwl.pif

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 3244	4520	66ae237c1680a6c0194d4a5ef883a146_JaffaCakes118.exe	93
PID 4520 wrote to memory of 3244	4520	66ae237c1680a6c0194d4a5ef883a146_JaffaCakes118.exe	93
PID 4520 wrote to memory of 3244	4520	66ae237c1680a6c0194d4a5ef883a146_JaffaCakes118.exe	93
PID 3244 wrote to memory of 4432	3244	lqilwl.pif	97
PID 3244 wrote to memory of 4432	3244	lqilwl.pif	97
PID 3244 wrote to memory of 4432	3244	lqilwl.pif	97
PID 3244 wrote to memory of 4432	3244	lqilwl.pif	97
PID 3244 wrote to memory of 4432	3244	lqilwl.pif	97

C:\Users\Admin\AppData\Local\Temp\66ae237c1680a6c0194d4a5ef883a146_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\66ae237c1680a6c0194d4a5ef883a146_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Users\Admin\AppData\Local\Temp\40791675\lqilwl.pif
  "C:\Users\Admin\AppData\Local\Temp\40791675\lqilwl.pif" wmrvmdcs.ije
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\40791675\lqilwl.pif

Filesize
649KB

MD5
e423fa6f72ef1a0d63ef5f85380657d6

SHA1
83114ec1db55867fde6d249352fcb3c52ef53af2

SHA256
4c38d6dc99e8219ccc923bddc94c9298f6b5aee6b4b42323d924cffdeafd356e

SHA512
687407a6354547f11faf190472e5fa5c50c0d01d911823b372d80029054e2e830c08b2a9100f5f1b1a742d0755bddfb784854bd7431f98b6b352010e2d01dac3

Download Submit
C:\Users\Admin\AppData\Local\Temp\40791675\mird.xml

Filesize
377KB

MD5
744295ad3e845c00badb2c4701521e8b

SHA1
039c5c54de34eb8a8fbb29d8ba0912d355e1293f

SHA256
b8cc7d152ee42023207babb9ea6511fea1565b7e5a4f43bbeb27d3f028c1e4c0

SHA512
1236d0dd7078064e7c4a1fe88e8696b53bef794fe754878c2d362a2ef418facbb5e386076912905ce611f6d12d9a95c0a20f4a8b699a3e412be5729a59f8362e

Download Submit
memory/4432-78-0x0000000000D00000-0x0000000001209000-memory.dmp

Filesize
5.0MB

Download
memory/4432-80-0x0000000000D00000-0x0000000001209000-memory.dmp

Filesize
5.0MB

Download
memory/4432-81-0x0000000000D00000-0x0000000001209000-memory.dmp

Filesize
5.0MB

Download
memory/4432-82-0x0000000000D00000-0x0000000001209000-memory.dmp

Filesize
5.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads