connect_ips.exe

General
Target

connect_ips.exe

Filesize

N/A

Completed

18-12-2019 04:29

Score
4 /10
SHA256

38a632c8d23aaddb53d7c0fb1d83a1414bbde238d84e6fa172149137b9ea09ac

Malware Config
Signatures 2

Filter: none

Discovery
  • Suspicious use of WriteProcessMemory
    connect_ips.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4812 wrote to memory of 48684812connect_ips.exeping.exe
    PID 4812 wrote to memory of 49004812connect_ips.exeping.exe
    PID 4812 wrote to memory of 49444812connect_ips.exeping.exe
    PID 4812 wrote to memory of 16204812connect_ips.exeping.exe
    PID 4812 wrote to memory of 3604812connect_ips.exeping.exe
  • Runs ping.exe
    ping.exeping.exeping.exeping.exeping.exe

    Tags

    TTPs

    Remote System Discovery

    Reported IOCs

    pidprocess
    1620ping.exe
    360ping.exe
    4868ping.exe
    4900ping.exe
    4944ping.exe
Processes 6
  • C:\Users\Admin\AppData\Local\Temp\connect_ips.exe
    "C:\Users\Admin\AppData\Local\Temp\connect_ips.exe"
    Suspicious use of WriteProcessMemory
    PID:4812
    • C:\Windows\system32\ping.exe
      ping 203.130.0.69 "-c 5" "-i 3" "-w 10"
      Runs ping.exe
      PID:4868
    • C:\Windows\system32\ping.exe
      ping 80.93.48.49 "-c 5" "-i 3" "-w 10"
      Runs ping.exe
      PID:4900
    • C:\Windows\system32\ping.exe
      ping 206.189.112.148 "-c 5" "-i 3" "-w 10"
      Runs ping.exe
      PID:4944
    • C:\Windows\system32\ping.exe
      ping 206.81.10.215 "-c 5" "-i 3" "-w 10"
      Runs ping.exe
      PID:1620
    • C:\Windows\system32\ping.exe
      ping 192.161.190.171 "-c 5" "-i 3" "-w 10"
      Runs ping.exe
      PID:360
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads