netwire | cd592c969a3a940e43888a1902ec9e4605ed28676d3945ab84d72175fbc87253

Analysis

max time kernel
172s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2022 17:45

Target

NisSrv.exe
Size

584KB
MD5

85f14631181a8867a2d41122482ba8dc
SHA1

8e2f2bce824c97cb8dd83c1736cd1de6897bb054
SHA256

bbcca0dc10b700c01e557612f009c050ca618f227e0b8be3d4f471dd9d887a18
SHA512

aec36afdc33880622492010ed028e679778abb8470a8e9517f8c241de0f8a158da3ce1c767e7671b5aab14c77624009e05af35472eb0d6c2e411918756f4d855
SSDEEP

6144:6toWmFzltNCF9NuUzSa3YYcahynDzcjzH1DFKH3oGu8EdoXRXHd:6toNFZj4QySHYca0UjzVDFKH3ox5y3

Score

10^/10

Family

netwire

54.145.6.146:443

Attributes

NetWire RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1004-138-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/1004-139-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/1004-140-0x0000000000400000-0x0000000000450000-memory.dmp	netwire
behavioral2/memory/1004-141-0x0000000000400000-0x0000000000450000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Suspicious use of SetThreadContext 1 IoCs

Processes:

NisSrv.exe

description pid process target process

PID 2912 set thread context of 1004 2912 NisSrv.exe AddInProcess32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

NisSrv.exe

pid process

2912 NisSrv.exe
2912 NisSrv.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

NisSrv.exe

description pid process

Token: SeDebugPrivilege 2912 NisSrv.exe

description	pid	process	target process
PID 2912 set thread context of 1004	2912	NisSrv.exe	AddInProcess32.exe

pid	process
2912	NisSrv.exe
2912	NisSrv.exe

description	pid	process
Token: SeDebugPrivilege	2912	NisSrv.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

NisSrv.exe

description	pid	process	target process
PID 2912 wrote to memory of 1004	2912	NisSrv.exe	AddInProcess32.exe
PID 2912 wrote to memory of 1004	2912	NisSrv.exe	AddInProcess32.exe
PID 2912 wrote to memory of 1004	2912	NisSrv.exe	AddInProcess32.exe
PID 2912 wrote to memory of 1004	2912	NisSrv.exe	AddInProcess32.exe
PID 2912 wrote to memory of 1004	2912	NisSrv.exe	AddInProcess32.exe
PID 2912 wrote to memory of 1004	2912	NisSrv.exe	AddInProcess32.exe
PID 2912 wrote to memory of 1004	2912	NisSrv.exe	AddInProcess32.exe
PID 2912 wrote to memory of 1004	2912	NisSrv.exe	AddInProcess32.exe
PID 2912 wrote to memory of 1004	2912	NisSrv.exe	AddInProcess32.exe
PID 2912 wrote to memory of 1004	2912	NisSrv.exe	AddInProcess32.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
2⤵
PID:1004

memory/1004-137-0x0000000000000000-mapping.dmp

Download
memory/1004-138-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1004-139-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1004-140-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1004-141-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2912-132-0x0000000000030000-0x00000000000C8000-memory.dmp

Filesize
608KB

Download
memory/2912-133-0x0000000004B20000-0x0000000004BBC000-memory.dmp

Filesize
624KB

Download
memory/2912-134-0x0000000008350000-0x00000000088F4000-memory.dmp

Filesize
5.6MB

Download
memory/2912-135-0x00000000080C0000-0x0000000008152000-memory.dmp

Filesize
584KB

Download
memory/2912-136-0x0000000008070000-0x000000000807A000-memory.dmp

Filesize
40KB

Download