Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 13:22
Static task
static1
Behavioral task
behavioral1
Sample
Bounced Cheque.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
Bounced Cheque.exe
-
Size
745KB
-
MD5
d0e7b058e35b998134e771b24f534b07
-
SHA1
9711b4478564484da540866df48c117f9d96fd4f
-
SHA256
249e738650027df7635aa70373e2e2f936eb58e1a208fdc8df9ee2f66e4cb9e3
-
SHA512
7f1b2c67f375a6225754a65eba3bcaed355672553265d70e16c0da4fbbd81c27a07d728f4cfccb1458a7d75061aa8b0d562db8e0f58fb03b82fdd671534ad506
Malware Config
Extracted
Family
netwire
C2
iphanyi.duckdns.org:3360
Attributes
-
activex_autorun
false
- activex_key
-
copy_executable
false
-
delete_original
false
-
host_id
SMS_Group
- install_path
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
- mutex
-
offline_keylogger
true
-
password
caster123
-
registry_autorun
false
- startup_name
-
use_mutex
false
Signatures
-
NetWire RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1768-61-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1768-62-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1768-63-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1768-65-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1768-67-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1768-66-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1768-70-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1768-71-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Bounced Cheque.exedescription pid process target process PID 1640 set thread context of 1768 1640 Bounced Cheque.exe Bounced Cheque.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Bounced Cheque.exepid process 1640 Bounced Cheque.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Bounced Cheque.exedescription pid process target process PID 1640 wrote to memory of 1768 1640 Bounced Cheque.exe Bounced Cheque.exe PID 1640 wrote to memory of 1768 1640 Bounced Cheque.exe Bounced Cheque.exe PID 1640 wrote to memory of 1768 1640 Bounced Cheque.exe Bounced Cheque.exe PID 1640 wrote to memory of 1768 1640 Bounced Cheque.exe Bounced Cheque.exe PID 1640 wrote to memory of 1768 1640 Bounced Cheque.exe Bounced Cheque.exe PID 1640 wrote to memory of 1768 1640 Bounced Cheque.exe Bounced Cheque.exe PID 1640 wrote to memory of 1768 1640 Bounced Cheque.exe Bounced Cheque.exe PID 1640 wrote to memory of 1768 1640 Bounced Cheque.exe Bounced Cheque.exe PID 1640 wrote to memory of 1768 1640 Bounced Cheque.exe Bounced Cheque.exe PID 1640 wrote to memory of 1768 1640 Bounced Cheque.exe Bounced Cheque.exe PID 1640 wrote to memory of 1768 1640 Bounced Cheque.exe Bounced Cheque.exe PID 1640 wrote to memory of 1768 1640 Bounced Cheque.exe Bounced Cheque.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bounced Cheque.exe"C:\Users\Admin\AppData\Local\Temp\Bounced Cheque.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Bounced Cheque.exe"C:\Users\Admin\AppData\Local\Temp\Bounced Cheque.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1768-56-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1768-57-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1768-59-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1768-61-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1768-62-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1768-63-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1768-65-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1768-67-0x000000000040242D-mapping.dmp
-
memory/1768-66-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1768-69-0x0000000076241000-0x0000000076243000-memory.dmpFilesize
8KB
-
memory/1768-70-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1768-71-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB