netwire | c1047a1415a679ddaba24fbc8a96efdb6c7da23b0c30513b108ab9ca5c4e4b95

Analysis

max time kernel
146s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 16:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84c0dd70e1cb3cf4c4d3ab5b020f85c3_JaffaCakes118.exe
Size

132KB
MD5

84c0dd70e1cb3cf4c4d3ab5b020f85c3
SHA1

4ab47546df8cfe92b3288c5d8701b0c55a8815e3
SHA256

c1047a1415a679ddaba24fbc8a96efdb6c7da23b0c30513b108ab9ca5c4e4b95
SHA512

71cc7c1d662663149c8bf0c8d2b6ae3bc10d8097ab39cd78b0c445dc2ee74bf3aebd0e43b4d69c0c128d2acfd398ba8a90431c15f3c1073de27ba6e808e35aa6
SSDEEP

1536:dtTSUSKzF0Lh9a7WraTWFbmDHVXWRVAzZ8MfUSl7Q3rwz5ggZG:dt5SKzF0Lh9a7IGW9GHeOFVvc3ruZG

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

127.0.0.1:3360

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
jamesemonkey
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
oYJRIRfr
offline_keylogger
true
password
AloraSealord2018!
registry_autorun
true
startup_name
NetWire
use_mutex
true

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Install\Host.exe	netwire
behavioral1/memory/2300-7-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/880-9-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

Host.exe

pid process

880 Host.exe
Loads dropped DLL 2 IoCs

Processes:

84c0dd70e1cb3cf4c4d3ab5b020f85c3_JaffaCakes118.exe

pid process

2300 84c0dd70e1cb3cf4c4d3ab5b020f85c3_JaffaCakes118.exe
2300 84c0dd70e1cb3cf4c4d3ab5b020f85c3_JaffaCakes118.exe

pid	process
880	Host.exe

pid	process
2300	84c0dd70e1cb3cf4c4d3ab5b020f85c3_JaffaCakes118.exe
2300	84c0dd70e1cb3cf4c4d3ab5b020f85c3_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe"	Host.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

84c0dd70e1cb3cf4c4d3ab5b020f85c3_JaffaCakes118.exe

description	pid	process	target process
PID 2300 wrote to memory of 880	2300	84c0dd70e1cb3cf4c4d3ab5b020f85c3_JaffaCakes118.exe	Host.exe
PID 2300 wrote to memory of 880	2300	84c0dd70e1cb3cf4c4d3ab5b020f85c3_JaffaCakes118.exe	Host.exe
PID 2300 wrote to memory of 880	2300	84c0dd70e1cb3cf4c4d3ab5b020f85c3_JaffaCakes118.exe	Host.exe
PID 2300 wrote to memory of 880	2300	84c0dd70e1cb3cf4c4d3ab5b020f85c3_JaffaCakes118.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\84c0dd70e1cb3cf4c4d3ab5b020f85c3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\84c0dd70e1cb3cf4c4d3ab5b020f85c3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2300

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:880

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
132KB

MD5
84c0dd70e1cb3cf4c4d3ab5b020f85c3

SHA1
4ab47546df8cfe92b3288c5d8701b0c55a8815e3

SHA256
c1047a1415a679ddaba24fbc8a96efdb6c7da23b0c30513b108ab9ca5c4e4b95

SHA512
71cc7c1d662663149c8bf0c8d2b6ae3bc10d8097ab39cd78b0c445dc2ee74bf3aebd0e43b4d69c0c128d2acfd398ba8a90431c15f3c1073de27ba6e808e35aa6

Download Submit
memory/880-9-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2300-7-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download