netwire | dfedae8d3b13ad57c1ce0abcccc3578c411e890fde8c118c64aa7b1564aeead4

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
Size

1.1MB
MD5

7e325204fdaa3d9a4be3facd66a01bf9
SHA1

72ae942dbdd61ab7256bac03a71c2f6488c4f381
SHA256

dfedae8d3b13ad57c1ce0abcccc3578c411e890fde8c118c64aa7b1564aeead4
SHA512

e91f5a3a8fd3e6800454eeba81c6489c3097d00f18e3126c036307f0d6909e91e618d26340fcadf4c7fc61a632f9fede8a8573f6712a3ad0f4d85b28ee834865
SSDEEP

24576:yAHnh+eWsN3skA4RV1Hom2KXMmHaCfIGCImN5:1h+ZkldoPK8YaCy

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

checklewis.ddns.net:3361

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
qbpWIrEm
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 2 IoCs
rat

Processes:

resource yara_rule

behavioral2/memory/1996-1-0x0000000000400000-0x000000000042C000-memory.dmp netwire
behavioral2/memory/1996-10-0x0000000000400000-0x000000000042C000-memory.dmp netwire
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

resource	yara_rule
behavioral2/memory/1996-1-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/1996-10-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Drops startup file 2 IoCs

Processes:

Host.exe7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url	Host.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

Host.exeHost.exe

pid process

3180 Host.exe
2728 Host.exe
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.

Processes:

resource yara_rule

C:\Users\Admin\AppData\Roaming\Install\Host.exe autoit_exe
C:\Users\Admin\.exe autoit_exe

pid	process
3180	Host.exe
2728	Host.exe

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Install\Host.exe	autoit_exe
C:\Users\Admin\.exe	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exeHost.exe

description	pid	process	target process
PID 4736 set thread context of 1996	4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
PID 3180 set thread context of 2728	3180	Host.exe	Host.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exeHost.exe

pid	process
4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
3180	Host.exe
3180	Host.exe
3180	Host.exe

Suspicious use of SendNotifyMessage 6 IoCs

Processes:

7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exeHost.exe

pid	process
4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
3180	Host.exe
3180	Host.exe
3180	Host.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exeHost.exe

description	pid	process	target process
PID 4736 wrote to memory of 1996	4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
PID 4736 wrote to memory of 1996	4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
PID 4736 wrote to memory of 1996	4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
PID 4736 wrote to memory of 1996	4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
PID 4736 wrote to memory of 1996	4736	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
PID 1996 wrote to memory of 3180	1996	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe	Host.exe
PID 1996 wrote to memory of 3180	1996	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe	Host.exe
PID 1996 wrote to memory of 3180	1996	7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe	Host.exe
PID 3180 wrote to memory of 2728	3180	Host.exe	Host.exe
PID 3180 wrote to memory of 2728	3180	Host.exe	Host.exe
PID 3180 wrote to memory of 2728	3180	Host.exe	Host.exe
PID 3180 wrote to memory of 2728	3180	Host.exe	Host.exe
PID 3180 wrote to memory of 2728	3180	Host.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4736

C:\Users\Admin\AppData\Local\Temp\7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7e325204fdaa3d9a4be3facd66a01bf9_JaffaCakes118.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3180

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
4⤵
- Executes dropped EXE
PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.exe
Filesize
1.1MB

MD5
f8d555e744670a1130c4ed09b091552a

SHA1
b557a0c8d3115da5c5fe435f07aa4362fa2729c3

SHA256
e65c486659347a2755e69271a6d97f277011a74332ab30760be8b9d0a654f95f

SHA512
c062f571a58093c16330d8a09ce4a6776ccc96c79211030b0aa3a74a32780ac73c4075f1332df86370ec981ee674bee5d01208ca4c556119293b8de82f24ae59

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
1.1MB

MD5
7e325204fdaa3d9a4be3facd66a01bf9

SHA1
72ae942dbdd61ab7256bac03a71c2f6488c4f381

SHA256
dfedae8d3b13ad57c1ce0abcccc3578c411e890fde8c118c64aa7b1564aeead4

SHA512
e91f5a3a8fd3e6800454eeba81c6489c3097d00f18e3126c036307f0d6909e91e618d26340fcadf4c7fc61a632f9fede8a8573f6712a3ad0f4d85b28ee834865

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1996-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1996-10-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4736-0-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download