Analysis
-
max time kernel
98s -
resource
win10v191014 -
submitted
18-12-2019 04:26
General
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
connect_ips.exedescription pid process target process PID 4812 wrote to memory of 4868 4812 connect_ips.exe ping.exe PID 4812 wrote to memory of 4900 4812 connect_ips.exe ping.exe PID 4812 wrote to memory of 4944 4812 connect_ips.exe ping.exe PID 4812 wrote to memory of 1620 4812 connect_ips.exe ping.exe PID 4812 wrote to memory of 360 4812 connect_ips.exe ping.exe -
Processes:
ping.exeping.exeping.exeping.exeping.exepid process 1620 ping.exe 360 ping.exe 4868 ping.exe 4900 ping.exe 4944 ping.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\connect_ips.exe"C:\Users\Admin\AppData\Local\Temp\connect_ips.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ping.exeping 203.130.0.69 "-c 5" "-i 3" "-w 10"2⤵
- Runs ping.exe
-
C:\Windows\system32\ping.exeping 80.93.48.49 "-c 5" "-i 3" "-w 10"2⤵
- Runs ping.exe
-
C:\Windows\system32\ping.exeping 206.189.112.148 "-c 5" "-i 3" "-w 10"2⤵
- Runs ping.exe
-
C:\Windows\system32\ping.exeping 206.81.10.215 "-c 5" "-i 3" "-w 10"2⤵
- Runs ping.exe
-
C:\Windows\system32\ping.exeping 192.161.190.171 "-c 5" "-i 3" "-w 10"2⤵
- Runs ping.exe