Overview

overview

10

Static

static

3

0C66BCEB98...12.exe

windows7-x64

10

0C66BCEB98...12.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_27c9db8522cd901fa26180e4b1ad2f0ecb63afa2ddeb8595a2a8cf07cb04160d

  • Size

    167.6MB

  • Sample

    241223-ws68mawrh1

  • MD5

    e5ca75cbddc894064050f2f0f11ff3e8

  • SHA1

    c6abbde27093b78aa1b114858de1e21b46b0b831

  • SHA256

    27c9db8522cd901fa26180e4b1ad2f0ecb63afa2ddeb8595a2a8cf07cb04160d

  • SHA512

    fe24a336f2c0ca1780a77643199e6296fccdc3ab0893a284922e85ffc910b40b6d05779721a5be6764a81f8cf3c3b1d9929f6c7bcc9645a1257fd529410fe722

  • SSDEEP

    3145728:m3roQz31A6ytBngP45sSFyd1dE2NkN5t5VcuZmD2Oj83CQiPtof/tjA5n0Eblq:Bii6yTggFO1MN5BpyQatoHHEU

Score
10/10
netwirebotnetdiscoveryexecutionpersistenceratstealer

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://i.top4top.io/m_1891i29ay1.mp4

Extracted

Family

netwire

C2

alice2019.myftp.biz:3360

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    FRAPPE2021

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      0C66BCEB98FEEC7DF1330747AA58AB43912F761BAE263ED1C30CF17301DA6D12

    • Size

      167.9MB

    • MD5

      3d2734b540298eb8db6d34908bf3187a

    • SHA1

      3b76909517bb5ffbedb702a5107f67d68a842faa

    • SHA256

      0c66bceb98feec7df1330747aa58ab43912f761bae263ed1c30cf17301da6d12

    • SHA512

      130508961df715bb6e721b79ce29d31469b03250c90d9a0f593b4c545836f7b9ed735d9c03c641921f8ab953033a268a51e9167eb89c9b7550b2c6c765f2c548

    • SSDEEP

      3145728:dqL+KfR/HQDWlnTJMf9XQcxePhX3vT5zm9XkPPQdjRC64g9u/4aIugUZxin8FKjO:Yhf5QDGntMfZ8XlYkQdj19WRIXmImMU

    Score
    10/10
    discoveryexecutionpersistencenetwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Netwire family

      netwire

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks