Overview

overview

10

Static

static

3

A2AE35821B...51.exe

windows7-x64

10

A2AE35821B...51.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6a78840e1b73af1f071ac1b9beb84f9298401a8ee371bc40d0aac7a40a18cbdb

  • Size

    17.6MB

  • Sample

    241229-268lhazmej

  • MD5

    e9ab07acba2f1621b4fd9f04bcf07929

  • SHA1

    e565c878fd5474d1e17f6607e32229535c80c094

  • SHA256

    6a78840e1b73af1f071ac1b9beb84f9298401a8ee371bc40d0aac7a40a18cbdb

  • SHA512

    ec323711adee3f9e7189c6d4ee3ffedbab015fd8ddca31648478384541a7af44d5a2b464854228d33cae89bfa531c79b4d88ee0d52daba97d2e8d0f6c04c460e

  • SSDEEP

    393216:ulZTZUYiSGx3AsOsVgIw5RbZS7CMtedkqxQHV6QQbdg4Xr4XY0ncr8zWZ:ulF2YiSG5APsVgD/orpHAQKdg6rgJcQ6

Score
10/10
netwirebotnetdiscoveryexecutionratstealer

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://i.top4top.io/m_1891i29ay1.mp4

Extracted

Family

netwire

C2

alice2019.myftp.biz:3360

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    FRAPPE2021

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      A2AE35821B702B7B0FD434A54AFA836E69C20904664CE1ED4D3181BA2B8AA051

    • Size

      17.7MB

    • MD5

      a5b839089ce5953f0ea149c5d9fa2d7a

    • SHA1

      767b6cea8c1c3f892cc2bf20d1a63e52c0376c39

    • SHA256

      a2ae35821b702b7b0fd434a54afa836e69c20904664ce1ed4d3181ba2b8aa051

    • SHA512

      0df01ca9702f52c8f41809a609d409da6f07f257ae05f6b379378213f1ce18ec00406fc8cc798b7cdf75c63ef763b973f57776bd7ed5d7ccf2457d486a1cdb3e

    • SSDEEP

      393216:iaB19LrFHgq7Pck/UibjnYPj77lYaDnHcqEhgAD:TPFHgKUk//rYPpYGHlqgm

    Score
    10/10
    discoveryexecutionnetwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Netwire family

      netwire

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks