bd771d1c4b005758dc4e3f27fc1bd5dcd58d566a0391763473c331930ab2ccd9

General

Target

connect_ips.exe
Sample

191218-5xa4zbpva6
SHA256

bd771d1c4b005758dc4e3f27fc1bd5dcd58d566a0391763473c331930ab2ccd9

Score

4^/10

evasion spreading

Malware Config

Signatures

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

connect_ips.exe

description	pid	process	target process
PID 1412 wrote to memory of 2000	1412	connect_ips.exe	ping.exe
PID 1412 wrote to memory of 2020	1412	connect_ips.exe	ping.exe
PID 1412 wrote to memory of 1020	1412	connect_ips.exe	ping.exe
PID 1412 wrote to memory of 552	1412	connect_ips.exe	ping.exe
PID 1412 wrote to memory of 884	1412	connect_ips.exe	ping.exe
PID 1412 wrote to memory of 1956	1412	connect_ips.exe	ping.exe
PID 1412 wrote to memory of 840	1412	connect_ips.exe	ping.exe
PID 1412 wrote to memory of 1456	1412	connect_ips.exe	ping.exe
PID 1412 wrote to memory of 1072	1412	connect_ips.exe	ping.exe
PID 1412 wrote to memory of 1184	1412	connect_ips.exe	ping.exe
PID 1412 wrote to memory of 1416	1412	connect_ips.exe	ping.exe
PID 1412 wrote to memory of 1844	1412	connect_ips.exe	ping.exe
PID 1412 wrote to memory of 612	1412	connect_ips.exe	ping.exe
PID 1412 wrote to memory of 1580	1412	connect_ips.exe	ping.exe
PID 1412 wrote to memory of 1540	1412	connect_ips.exe	ping.exe
PID 1412 wrote to memory of 1068	1412	connect_ips.exe	ping.exe
PID 1412 wrote to memory of 1736	1412	connect_ips.exe	ping.exe

Runs ping.exe 1 TTPs 17 IoCs

evasion spreading

Remote System Discovery

T1018

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid	process
2000	ping.exe
552	ping.exe
1072	ping.exe
1184	ping.exe
1416	ping.exe
1956	ping.exe
840	ping.exe
612	ping.exe
1540	ping.exe
2020	ping.exe
884	ping.exe
1736	ping.exe
1020	ping.exe
1456	ping.exe
1844	ping.exe
1580	ping.exe
1068	ping.exe

C:\Users\Admin\AppData\Local\Temp\connect_ips.exe
"C:\Users\Admin\AppData\Local\Temp\connect_ips.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1412

C:\Windows\system32\ping.exe
ping 50.116.86.205 "-c 5" "-i 3" "-w 10"
2⤵
- Runs ping.exe
PID:2000

C:\Windows\system32\ping.exe
ping 209.97.168.52 "-c 5" "-i 3" "-w 10"
2⤵
- Runs ping.exe
PID:2020

C:\Windows\system32\ping.exe
ping 197.254.221.174 "-c 5" "-i 3" "-w 10"
2⤵
- Runs ping.exe
PID:1020

C:\Windows\system32\ping.exe
ping 190.186.164.23 "-c 5" "-i 3" "-w 10"
2⤵
- Runs ping.exe
PID:552

C:\Windows\system32\ping.exe
ping 80.93.48.49 "-c 5" "-i 3" "-w 10"
2⤵
- Runs ping.exe
PID:884

C:\Windows\system32\ping.exe
ping 146.185.253.123 "-c 5" "-i 3" "-w 10"
2⤵
- Runs ping.exe
PID:1956

C:\Windows\system32\ping.exe
ping 163.172.97.112 "-c 5" "-i 3" "-w 10"
2⤵
- Runs ping.exe
PID:840

C:\Windows\system32\ping.exe
ping 107.170.24.125 "-c 5" "-i 3" "-w 10"
2⤵
- Runs ping.exe
PID:1456

C:\Windows\system32\ping.exe
ping 47.187.70.124 "-c 5" "-i 3" "-w 10"
2⤵
- Runs ping.exe
PID:1072

C:\Windows\system32\ping.exe
ping 206.81.10.215 "-c 5" "-i 3" "-w 10"
2⤵
- Runs ping.exe
PID:1184

C:\Windows\system32\ping.exe
ping 181.196.207.202 "-c 5" "-i 3" "-w 10"
2⤵
- Runs ping.exe
PID:1416

C:\Windows\system32\ping.exe
ping 181.112.157.42 "-c 5" "-i 3" "-w 10"
2⤵
- Runs ping.exe
PID:1844

C:\Windows\system32\ping.exe
ping 128.65.154.183 "-c 5" "-i 3" "-w 10"
2⤵
- Runs ping.exe
PID:612

C:\Windows\system32\ping.exe
ping 101.187.247.29 "-c 5" "-i 3" "-w 10"
2⤵
- Runs ping.exe
PID:1580

C:\Windows\system32\ping.exe
ping 72.27.212.209 "-c 5" "-i 3" "-w 10"
2⤵
- Runs ping.exe
PID:1540

C:\Windows\system32\ping.exe
ping 91.205.173.54 "-c 5" "-i 3" "-w 10"
2⤵
- Runs ping.exe
PID:1068

C:\Windows\system32\ping.exe
ping 85.217.171.229 "-c 5" "-i 3" "-w 10"
2⤵
- Runs ping.exe
PID:1736

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads