netwire | 9388d5c99546d163b0faa6c1212142996a455696fc44a393f4593a58e04b21e9

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
Size

689KB
MD5

a0d51a380de1987d828f8454b11c284b
SHA1

b68a9a468cef7665d5e5b35e2e5ce3b809d2dc8e
SHA256

9388d5c99546d163b0faa6c1212142996a455696fc44a393f4593a58e04b21e9
SHA512

5bb8d6f50efdaa7e340bb1a821989e68f45a55167a43b840201e8b4fcc8d98cd6baf932740c8b32fc1e173777d9ce49ed8e2f28671ed9e9d34e9c56d9b07569d
SSDEEP

12288:0BC1tAx0SFUAvfoW6YovGFJyP+wlk+Spy+8l/6jR6fHecv9nslZbQZXsborvFY0E:1159J4vYzUdMrM

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

blessedwithwealth.servehumour.com:39560

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
sunshineslisa
keylogger_dir
%AppData%\Logs\Imgburn\
lock_executable
false
offline_keylogger
true
password
sucess
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4400-3-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/4400-7-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/4400-9-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe

pid	process
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe

description	pid	process	target process
PID 1976 wrote to memory of 1500	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 1976 wrote to memory of 1500	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 1976 wrote to memory of 1500	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 1976 wrote to memory of 2692	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 1976 wrote to memory of 2692	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 1976 wrote to memory of 2692	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 1976 wrote to memory of 4904	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 1976 wrote to memory of 4904	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 1976 wrote to memory of 4904	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 1976 wrote to memory of 4400	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 1976 wrote to memory of 4400	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 1976 wrote to memory of 4400	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 1976 wrote to memory of 4400	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 1976 wrote to memory of 4400	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 1976 wrote to memory of 4400	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 1976 wrote to memory of 4400	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 1976 wrote to memory of 4400	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 1976 wrote to memory of 4400	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 1976 wrote to memory of 4400	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 1976 wrote to memory of 4400	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 1976 wrote to memory of 4400	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe
PID 1976 wrote to memory of 4400	1976	a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe	calc.exe

C:\Users\Admin\AppData\Local\Temp\a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a0d51a380de1987d828f8454b11c284b_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\calc.exe
calc.exe
2⤵
PID:1500

C:\Windows\SysWOW64\calc.exe
calc.exe
2⤵
PID:2692

C:\Windows\SysWOW64\calc.exe
calc.exe
2⤵
PID:4904

C:\Windows\SysWOW64\calc.exe
calc.exe
2⤵
PID:4400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-0-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/1976-1-0x0000000002420000-0x000000000249B000-memory.dmp

Filesize
492KB

Download
memory/1976-2-0x00000000772D2000-0x00000000772D3000-memory.dmp

Filesize
4KB

Download
memory/1976-4-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/1976-5-0x0000000002420000-0x000000000249B000-memory.dmp

Filesize
492KB

Download
memory/4400-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4400-6-0x00000000772D2000-0x00000000772D3000-memory.dmp

Filesize
4KB

Download
memory/4400-7-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4400-8-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/4400-9-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download