Overview

overview

8

Static

static

Replycant.exe

windows7_x64

8

Replycant.exe

windows10_x64

8

Resubmissions

14-02-2020 12:34

200214-b6b4743yan 8

13-02-2020 20:57

200213-jdvkxel2ma 10

Analysis

  • max time kernel
    105s
  • max time network
    116s
  • platform
    windows7_x64
  • resource
    win7v200213
  • submitted
    13-02-2020 20:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Replycant.exe

  • Size

    496KB

  • MD5

    d04c9993c11e884472533b869576fdb5

  • SHA1

    103657d9912a422ba94d5da365acc800a46cad5e

  • SHA256

    dd811507f8068ee522a68aeb52ce6eb14f5b4382e6da2386c305087eebbc853e

  • SHA512

    5d8c28d9b1a875db96282ea532fac16ddc07d81ce5c11a849b077f0c73cba6d00cb1ccd109ca6447c337ae6a081b7a47f9cb3edcc631d305c9753beed698e83c

Score
10/10
trojanbankertrickbot

Malware Config

Extracted

Family

trickbot

Version

1000498

Botnet

ono30

C2

5.182.210.226:443

82.146.62.52:443

164.68.120.56:443

185.11.146.86:443

5.2.78.70:443

185.65.202.240:443

193.26.217.243:443

81.177.180.254:443

5.34.177.40:443

185.186.77.222:443

188.227.84.209:443

193.26.217.243:443

185.45.193.76:443

46.229.213.27:443

88.99.112.87:443

51.254.164.240:443

45.148.120.13:443

5.2.78.77:443

64.44.51.125:443

107.172.165.149:443
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Suspicious use of WriteProcessMemory 10 IoCs
  • Executes dropped EXE 1 IoCs
  • Trickbot's 32bit loader

    Detects Trickbot's 32bit loader.

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Loads dropped DLL 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Replycant.exe
    "C:\Users\Admin\AppData\Local\Temp\Replycant.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious use of SetWindowsHookEx
    • Loads dropped DLL
    PID:1992
    • C:\ProgramData\بابկողպեքドアЕЕقفلпԴուь;;;ռըсロックロック.exe
      "C:\ProgramData\بابկողպեքドアЕЕقفلпԴուь;;;ռըсロックロック.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2024
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:1040

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\بابկողպեքドアЕЕقفلпԴուь;;;ռըсロックロック.exe
      Download Submit
    • C:\ProgramData\بابկողպեքドアЕЕقفلпԴուь;;;ռըсロックロック.exe
      Download Submit
    • \ProgramData\بابկողպեքドアЕЕقفلпԴուь;;;ռըсロックロック.exe
      Download Submit
    • \ProgramData\بابկողպեքドアЕЕقفلпԴուь;;;ռըсロックロック.exe
      Download Submit
    • memory/1992-0-0x0000000000480000-0x00000000004B4000-memory.dmp
      Filesize

      208KB

      Download
    • memory/2024-4-0x0000000000580000-0x00000000005B4000-memory.dmp
      Filesize

      208KB

      Download
    • memory/2024-6-0x0000000000610000-0x0000000000641000-memory.dmp
      Filesize

      196KB

      Download