netwire | c8f71c7078e8667e79d827762ad65bcbc311195da00e87df782a30424e6f93af

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

acb2840b575bd538efdd76ada3a603a2_JaffaCakes118.exe
Size

1022KB
MD5

acb2840b575bd538efdd76ada3a603a2
SHA1

e871d22c8443eb556e897d18d77e6e8ead667cce
SHA256

c8f71c7078e8667e79d827762ad65bcbc311195da00e87df782a30424e6f93af
SHA512

e938e85070bc9e30cb3a9690c35dea55da4389cb30621c163f35170570ee6a245f2b2b1376bcdfaf3e070b83a9cb3cd72cc5639e19bd12247903abd547109a75
SSDEEP

1536:4Wp4doeVY9nzccb43+o/20t5Yrpq/nvR803E58XK5MhGJ/fYWCJzw8YeEvi7gaF3:rGoxzA3+o/20t5YIvHuImoP0vtuF4q

Score

10^/10

netwire njrat hacked botnet evasion persistence rat stealer trojan

Malware Config

Extracted

Family

netwire

91.192.100.3:1199

Attributes

activex_autorun
true
activex_key
{0841AJ8U-8PI0-YXLN-18O6-2786QVLQ43VL}
copy_executable
true
delete_original
false
host_id
Bushbush
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
QKiFRiUe
offline_keylogger
true
password
Password
registry_autorun
true
startup_name
Avast
use_mutex
true

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

91.192.100.3:1406

Mutex

b6d8b4f8ec6a24a915c0dbdb3f24d168

Attributes

reg_key
b6d8b4f8ec6a24a915c0dbdb3f24d168
splitter
|'|'|

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Host.exe	netwire
behavioral1/memory/2512-49-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral1/memory/2696-51-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0841AJ8U-8PI0-YXLN-18O6-2786QVLQ43VL}	Host.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0841AJ8U-8PI0-YXLN-18O6-2786QVLQ43VL}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\""	Host.exe

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

1048 netsh.exe

pid	process
1048	netsh.exe

Drops startup file 2 IoCs

Processes:

acb2840b575bd538efdd76ada3a603a2_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\filename.exe	acb2840b575bd538efdd76ada3a603a2_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\filename.exe	acb2840b575bd538efdd76ada3a603a2_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

Processes:

Host.exeServer.exeHost.exe

pid process

2512 Host.exe
2580 Server.exe
2696 Host.exe
Loads dropped DLL 9 IoCs

Processes:

RegAsm.exeHost.exe

pid process

2308 RegAsm.exe
2308 RegAsm.exe
2308 RegAsm.exe
2308 RegAsm.exe
2308 RegAsm.exe
2308 RegAsm.exe
2308 RegAsm.exe
2512 Host.exe
2512 Host.exe

pid	process
2512	Host.exe
2580	Server.exe
2696	Host.exe

pid	process
2308	RegAsm.exe
2308	RegAsm.exe
2308	RegAsm.exe
2308	RegAsm.exe
2308	RegAsm.exe
2308	RegAsm.exe
2308	RegAsm.exe
2512	Host.exe
2512	Host.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Host.exeServer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Avast = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe"	Host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\b6d8b4f8ec6a24a915c0dbdb3f24d168 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe\" .."	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\b6d8b4f8ec6a24a915c0dbdb3f24d168 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe\" .."	Server.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

acb2840b575bd538efdd76ada3a603a2_JaffaCakes118.exe

description pid process target process

PID 2340 set thread context of 2308 2340 acb2840b575bd538efdd76ada3a603a2_JaffaCakes118.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 2340 set thread context of 2308	2340	acb2840b575bd538efdd76ada3a603a2_JaffaCakes118.exe	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

Server.exe

description	pid	process
Token: SeDebugPrivilege	2580	Server.exe
Token: 33	2580	Server.exe
Token: SeIncBasePriorityPrivilege	2580	Server.exe
Token: 33	2580	Server.exe
Token: SeIncBasePriorityPrivilege	2580	Server.exe
Token: 33	2580	Server.exe
Token: SeIncBasePriorityPrivilege	2580	Server.exe
Token: 33	2580	Server.exe
Token: SeIncBasePriorityPrivilege	2580	Server.exe
Token: 33	2580	Server.exe
Token: SeIncBasePriorityPrivilege	2580	Server.exe
Token: 33	2580	Server.exe
Token: SeIncBasePriorityPrivilege	2580	Server.exe
Token: 33	2580	Server.exe
Token: SeIncBasePriorityPrivilege	2580	Server.exe
Token: 33	2580	Server.exe
Token: SeIncBasePriorityPrivilege	2580	Server.exe
Token: 33	2580	Server.exe
Token: SeIncBasePriorityPrivilege	2580	Server.exe
Token: 33	2580	Server.exe
Token: SeIncBasePriorityPrivilege	2580	Server.exe
Token: 33	2580	Server.exe
Token: SeIncBasePriorityPrivilege	2580	Server.exe
Token: 33	2580	Server.exe
Token: SeIncBasePriorityPrivilege	2580	Server.exe
Token: 33	2580	Server.exe
Token: SeIncBasePriorityPrivilege	2580	Server.exe
Token: 33	2580	Server.exe
Token: SeIncBasePriorityPrivilege	2580	Server.exe
Token: 33	2580	Server.exe
Token: SeIncBasePriorityPrivilege	2580	Server.exe
Token: 33	2580	Server.exe
Token: SeIncBasePriorityPrivilege	2580	Server.exe
Token: 33	2580	Server.exe
Token: SeIncBasePriorityPrivilege	2580	Server.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

acb2840b575bd538efdd76ada3a603a2_JaffaCakes118.exeRegAsm.exeHost.exeServer.exe

description	pid	process	target process
PID 2340 wrote to memory of 2308	2340	acb2840b575bd538efdd76ada3a603a2_JaffaCakes118.exe	RegAsm.exe
PID 2340 wrote to memory of 2308	2340	acb2840b575bd538efdd76ada3a603a2_JaffaCakes118.exe	RegAsm.exe
PID 2340 wrote to memory of 2308	2340	acb2840b575bd538efdd76ada3a603a2_JaffaCakes118.exe	RegAsm.exe
PID 2340 wrote to memory of 2308	2340	acb2840b575bd538efdd76ada3a603a2_JaffaCakes118.exe	RegAsm.exe
PID 2340 wrote to memory of 2308	2340	acb2840b575bd538efdd76ada3a603a2_JaffaCakes118.exe	RegAsm.exe
PID 2340 wrote to memory of 2308	2340	acb2840b575bd538efdd76ada3a603a2_JaffaCakes118.exe	RegAsm.exe
PID 2340 wrote to memory of 2308	2340	acb2840b575bd538efdd76ada3a603a2_JaffaCakes118.exe	RegAsm.exe
PID 2340 wrote to memory of 2308	2340	acb2840b575bd538efdd76ada3a603a2_JaffaCakes118.exe	RegAsm.exe
PID 2340 wrote to memory of 2308	2340	acb2840b575bd538efdd76ada3a603a2_JaffaCakes118.exe	RegAsm.exe
PID 2340 wrote to memory of 2308	2340	acb2840b575bd538efdd76ada3a603a2_JaffaCakes118.exe	RegAsm.exe
PID 2340 wrote to memory of 2308	2340	acb2840b575bd538efdd76ada3a603a2_JaffaCakes118.exe	RegAsm.exe
PID 2308 wrote to memory of 2512	2308	RegAsm.exe	Host.exe
PID 2308 wrote to memory of 2512	2308	RegAsm.exe	Host.exe
PID 2308 wrote to memory of 2512	2308	RegAsm.exe	Host.exe
PID 2308 wrote to memory of 2512	2308	RegAsm.exe	Host.exe
PID 2308 wrote to memory of 2580	2308	RegAsm.exe	Server.exe
PID 2308 wrote to memory of 2580	2308	RegAsm.exe	Server.exe
PID 2308 wrote to memory of 2580	2308	RegAsm.exe	Server.exe
PID 2308 wrote to memory of 2580	2308	RegAsm.exe	Server.exe
PID 2512 wrote to memory of 2696	2512	Host.exe	Host.exe
PID 2512 wrote to memory of 2696	2512	Host.exe	Host.exe
PID 2512 wrote to memory of 2696	2512	Host.exe	Host.exe
PID 2512 wrote to memory of 2696	2512	Host.exe	Host.exe
PID 2580 wrote to memory of 1048	2580	Server.exe	netsh.exe
PID 2580 wrote to memory of 1048	2580	Server.exe	netsh.exe
PID 2580 wrote to memory of 1048	2580	Server.exe	netsh.exe
PID 2580 wrote to memory of 1048	2580	Server.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\acb2840b575bd538efdd76ada3a603a2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\acb2840b575bd538efdd76ada3a603a2_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2340

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2308

C:\Users\Admin\AppData\Local\Temp\Host.exe
"C:\Users\Admin\AppData\Local\Temp\Host.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
PID:2696

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE
4⤵
- Modifies Windows Firewall
PID:1048

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Host.exe
Filesize
132KB

MD5
e6816a314a4cb6ab308e9b8066e61baa

SHA1
86baae6075ddf7c05bb67788c3e4844385f5b5cc

SHA256
f6307bac4e2e5a5d006461bc0e614acb738c86cf0ea6a606c7c72fa72074e81e

SHA512
1bae0eed5177de9c828bc3d40889afe0eba064d49bd4830aa0c9ed234b0baa521fd62d30499eed4c64f2aafcb8dfb055042b0b5c7c1e1b761d68428b6bf6c648

Download Submit
\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
23KB

MD5
728611dc09fdcba13bbcca5247956cd0

SHA1
7ffa8dd6838120a4e5fa0b6af25e71dfe9a5778a

SHA256
130281a00892bb6f5ed16c8c3ebf3b2a5105a475d914a3fa2c341586d427878b

SHA512
3ea67e97a558836f8ce696d6b4f67c14f581df810f13415b6dabc6e26ba9d9a79a1c8e6048faf16da99c52d2c7e261a25c8513e448154968c6d705956dafeb81

Download Submit
memory/2308-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2308-4-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2308-9-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2308-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2308-6-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2308-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2340-0-0x0000000074B91000-0x0000000074B92000-memory.dmp

Filesize
4KB

Download
memory/2340-13-0x0000000074B90000-0x000000007513B000-memory.dmp

Filesize
5.7MB

Download
memory/2340-2-0x0000000074B90000-0x000000007513B000-memory.dmp

Filesize
5.7MB

Download
memory/2340-1-0x0000000074B90000-0x000000007513B000-memory.dmp

Filesize
5.7MB

Download
memory/2512-49-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2696-51-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download