Overview

overview

8

Static

static

galadriel

windows7_x64

8

Resubmissions

14-02-2020 12:34

200214-b6b4743yan 8

13-02-2020 20:57

200213-jdvkxel2ma 10

Analysis

  • max time kernel
    245s
  • max time network
    105s
  • platform
    windows7_x64
  • resource
    win7v200213
  • submitted
    14-02-2020 12:34

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Replycant.exe

  • Size

    496KB

  • MD5

    d04c9993c11e884472533b869576fdb5

  • SHA1

    103657d9912a422ba94d5da365acc800a46cad5e

  • SHA256

    dd811507f8068ee522a68aeb52ce6eb14f5b4382e6da2386c305087eebbc853e

  • SHA512

    5d8c28d9b1a875db96282ea532fac16ddc07d81ce5c11a849b077f0c73cba6d00cb1ccd109ca6447c337ae6a081b7a47f9cb3edcc631d305c9753beed698e83c

Score
8/10

Malware Config

Signatures

  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Replycant.exe
    "C:\Users\Admin\AppData\Local\Temp\Replycant.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\ProgramData\بابկողպեքドアЕЕقفلпԴուь;;;ռըсロックロック.exe
      "C:\ProgramData\بابկողպեքドアЕЕقفلпԴուь;;;ռըсロックロック.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      PID:2036
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:1132
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {A7E80347-95CE-46AE-994E-9CFAF62A02BA} S-1-5-18:NT AUTHORITY\System:Service:
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1632
      • C:\Users\Admin\AppData\Roaming\FileSyncEx\بابկողպեքドアЕЕقفلпԴուь;;;ռըсロックロック.exe
        C:\Users\Admin\AppData\Roaming\FileSyncEx\بابկողպեքドアЕЕقفلпԴուь;;;ռըсロックロック.exe
        2⤵
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • Executes dropped EXE
        PID:1720
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1744

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\بابկողպեքドアЕЕقفلпԴուь;;;ռըсロックロック.exe
      Download Submit
    • C:\ProgramData\بابկողպեքドアЕЕقفلпԴուь;;;ռըсロックロック.exe
      Download Submit
    • C:\Users\Admin\AppData\Roaming\FileSyncEx\بابկողպեքドアЕЕقفلпԴուь;;;ռըсロックロック.exe
      Download Submit
    • C:\Users\Admin\AppData\Roaming\FileSyncEx\بابկողպեքドアЕЕقفلпԴուь;;;ռըсロックロック.exe
      Download Submit
    • \ProgramData\بابկողպեքドアЕЕقفلпԴուь;;;ռըсロックロック.exe
      Download Submit
    • \ProgramData\بابկողպեքドアЕЕقفلпԴուь;;;ռըсロックロック.exe
      Download Submit
    • memory/1720-9-0x00000000009E0000-0x0000000000A14000-memory.dmp
      Filesize

      208KB

      Download
    • memory/2000-0-0x0000000001D40000-0x0000000001D74000-memory.dmp
      Filesize

      208KB

      Download
    • memory/2036-4-0x0000000001BE0000-0x0000000001C14000-memory.dmp
      Filesize

      208KB

      Download
    • memory/2036-6-0x0000000001C60000-0x0000000001C91000-memory.dmp
      Filesize

      196KB

      Download