netwire | a7374e3645615c6c1c7326ccdab9c6743ed71723397524a15b1548d2c1a24a15

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exe
Size

392KB
MD5

af79eb8a77c46f99d2a80841353679d2
SHA1

d07a388f144864a69d3b1fb9f6b83a5a9fc01b4d
SHA256

a7374e3645615c6c1c7326ccdab9c6743ed71723397524a15b1548d2c1a24a15
SHA512

aa88e883bf3f1c1387283e0e68b40cf13e55501c328ac26efa663c943d9b9bf6f8f0e0d5a8162783feadde3d2e4f7279d6a327ba9c2dc2e77c05042e42e5e3c4
SSDEEP

6144:fNXqRB78GUgn+DTCcfBLy+SnpsuXBKnVN0tYyvrn:VXqr78GU8G98RKVGr

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

wealthyman.brasilia.me:39560

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
WEALTH
keylogger_dir
%AppData%\music\
lock_executable
false
offline_keylogger
true
password
sucess
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral2/memory/3780-17900-0x0000000000400000-0x000000000042C000-memory.dmp netwire
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

af79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation af79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exe
Executes dropped EXE 1 IoCs

Processes:

Bantamvgteren.exe

pid process

3780 Bantamvgteren.exe
Drops file in Windows directory 2 IoCs

Processes:

Bantamvgteren.exeaf79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exe

description ioc process

File opened for modification C:\Windows\win.ini Bantamvgteren.exe
File opened for modification C:\Windows\win.ini af79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

5004 schtasks.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

af79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exeBantamvgteren.exe

pid process

332 af79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exe
3780 Bantamvgteren.exe

resource	yara_rule
behavioral2/memory/3780-17900-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	af79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exe

pid	process
3780	Bantamvgteren.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	Bantamvgteren.exe
File opened for modification	C:\Windows\win.ini	af79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exe

pid	process
5004	schtasks.exe

pid	process
332	af79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exe
3780	Bantamvgteren.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

af79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exe

description	pid	process	target process
PID 332 wrote to memory of 5004	332	af79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exe	schtasks.exe
PID 332 wrote to memory of 5004	332	af79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exe	schtasks.exe
PID 332 wrote to memory of 5004	332	af79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exe	schtasks.exe
PID 332 wrote to memory of 4308	332	af79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exe	schtasks.exe
PID 332 wrote to memory of 4308	332	af79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exe	schtasks.exe
PID 332 wrote to memory of 4308	332	af79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\af79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\af79eb8a77c46f99d2a80841353679d2_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN "Minters4" /TR "C:\Users\Admin\AppData\Local\Temp\Bantamvgteren.exe"
2⤵
- Creates scheduled task(s)
PID:5004

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /run /tn "Minters4"
2⤵
PID:4308

C:\Users\Admin\AppData\Local\Temp\Bantamvgteren.exe
C:\Users\Admin\AppData\Local\Temp\Bantamvgteren.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4428

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Bantamvgteren.exe
Filesize
392KB

MD5
cd2bd627123db0ea0c2bbb428e830bfb

SHA1
3cc80c258bb30b2ad4815427ec57b7a19ba2cc00

SHA256
480310f5e5d0605c22a5cf739559a6f2176220b0df7a488ae1753ca33e186a46

SHA512
e4ac28d670eb47733e1368dc1b8b8864943e552bd17bc682bd56920c21e218264f555f3833f1e9733cf706b45ac26e7d7c9280b50136e9facf25bc5340bcb1a2

Download Submit
C:\Windows\win.ini
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/332-8947-0x00000000779A1000-0x0000000077AC1000-memory.dmp

Filesize
1.1MB

Download
memory/3780-17900-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3780-17906-0x0000000075660000-0x0000000075780000-memory.dmp

Filesize
1.1MB

Download