netwire | ee1a3b6747408c19a04a7bd69a4af9d81e71637a49ea16834e9e5ad381be4241

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe
Size

250KB
MD5

81e62e155aa60cb563f4abb72e2d7545
SHA1

64c7ff05b6043a53e3c5b32f9d1610c7a711b274
SHA256

ee1a3b6747408c19a04a7bd69a4af9d81e71637a49ea16834e9e5ad381be4241
SHA512

906352611c7dc7b8204ad91faacba3f89006245f6d6d739fe24dfcd2edf4e8c48323009f7fafb96ea072d0affaaa80ce78456b7d151a6b0d24514c04eba0ecba
SSDEEP

6144:q1BLCofs/ic8Uo1DeXggJYXRYhxhjuk618HMqWIpbsQO:oLCCsKsuUJY2GH8KUQx

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

mardjdf.ug:6974

kjsdtrfuyhgxcv.ru:6974

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Tlogs\
lock_executable
false
mutex
hgdGIATE
offline_keylogger
true
password
rdfs34df32sdf
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 2 IoCs
rat

Processes:

resource yara_rule

behavioral1/memory/2620-24-0x0000000000400000-0x000000000042B000-memory.dmp netwire
behavioral1/memory/2620-25-0x0000000000400000-0x000000000042B000-memory.dmp netwire
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Drops startup file 1 IoCs

Processes:

81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kjhgcxvbe.vbs 81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe

description pid process target process

PID 3020 set thread context of 2620 3020 81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe svchost.exe

resource	yara_rule
behavioral1/memory/2620-24-0x0000000000400000-0x000000000042B000-memory.dmp	netwire
behavioral1/memory/2620-25-0x0000000000400000-0x000000000042B000-memory.dmp	netwire

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kjhgcxvbe.vbs	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe

description	pid	process	target process
PID 3020 set thread context of 2620	3020	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe

pid	process
3020	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe
3020	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe
3020	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe
3020	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe

pid process

3020 81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe

description	pid	process	target process
PID 3020 wrote to memory of 2620	3020	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 2620	3020	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 2620	3020	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 2620	3020	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe	svchost.exe
PID 3020 wrote to memory of 2620	3020	81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3020

C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe"
2⤵
PID:2620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2620-24-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2620-25-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3020-16-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-13-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-11-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-21-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-20-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-19-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-18-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-17-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-1-0x0000000000240000-0x0000000000340000-memory.dmp

Filesize
1024KB

Download
memory/3020-15-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-14-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-4-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-12-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-10-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-9-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-8-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-7-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-6-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-5-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3020-3-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/3020-2-0x00000000000F0000-0x00000000000F5000-memory.dmp

Filesize
20KB

Download