Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Program Files (x86)\Split Files\SplitFiles131.exe

"C:\Program Files (x86)\Split Files\SplitFiles131.exe"

Details

Is windows:	false
Is dropped:	true
PID:	4948
Target ID:	2
Parent PID:	3132
Name:	SplitFiles131.exe
Path:	C:\Program Files (x86)\Split Files\SplitFiles131.exe
Commandline:	"C:\Program Files (x86)\Split Files\SplitFiles131.exe"
Size:	3299023
MD5:	D26C02425FA67FBDC0E4B4D5D6FA6088
Time:	09:17:02
Date:	05/01/2023
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	17981440
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Detected unpacking (changes PE section rights)	Data Obfuscation	Software Packing
Detected unpacking (overwrites its own PE header)	Compliance, Data Obfuscation	Software Packing
Yara detected Nymaim	E-Banking Fraud, Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Uses taskkill to terminate processes	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Queries process information (via WMI, Win32_Process)	System Summary	System Information Discovery Windows Management Instrumentation
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\rf6CwnLa.exe

Details

Is windows:	false
Is dropped:	true
PID:	588
Target ID:	3
Parent PID:	4948
Name:	rf6CwnLa.exe
Path:	C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\rf6CwnLa.exe
Commandline:
Size:	73728
MD5:	3FB36CB0B7172E5298D2992D42984D06
Time:	09:17:06
Date:	05/01/2023
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x1300000
Modulesize:	90112
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Spawns processes	System Summary	Process Injection

C:\Users\user\Desktop\file.exe

Details

Is windows:	false
Is dropped:	false
PID:	1968
Target ID:	0
Parent PID:	3528
Name:	file.exe
Path:	C:\Users\user\Desktop\file.exe
Commandline:	C:\Users\user\Desktop\file.exe
Size:	1970815
MD5:	4206F8B371294F11B01592ACC7BB338D
Time:	09:16:58
Date:	05/01/2023
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	196608
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Temp\is-GA371.tmp\is-EPSRP.tmp

"C:\Users\user\AppData\Local\Temp\is-GA371.tmp\is-EPSRP.tmp" /SL4 $502DC "C:\Users\user\Desktop\file.exe" 1694939 170496

Details

Is windows:	false
Is dropped:	true
PID:	3132
Target ID:	1
Parent PID:	1968
Name:	is-EPSRP.tmp
Path:	C:\Users\user\AppData\Local\Temp\is-GA371.tmp\is-EPSRP.tmp
Commandline:	"C:\Users\user\AppData\Local\Temp\is-GA371.tmp\is-EPSRP.tmp" /SL4 $502DC "C:\Users\user\Desktop\file.exe" 1694939 170496
Size:	778752
MD5:	E8176050192FBB976D70238E3C121F4C
Time:	09:16:59
Date:	05/01/2023
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	966656
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Enumerates the file system	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c taskkill /im "SplitFiles131.exe" /f & erase "C:\Program Files (x86)\Split Files\SplitFiles131.exe" & exit

Details

Is windows:	true
Is dropped:	false
PID:	2264
Target ID:	4
Parent PID:	4948
Name:	cmd.exe
Class:	cmd
Path:	C:\Windows\SysWOW64\cmd.exe
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /im "SplitFiles131.exe" /f & erase "C:\Program Files (x86)\Split Files\SplitFiles131.exe" & exit
Size:	232960
MD5:	F3BDBE3BB6F734E357235F4D5898582D
Time:	09:17:36
Date:	05/01/2023
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xd90000
Modulesize:	364544
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	4788
Target ID:	5
Parent PID:	2264
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	625664
MD5:	EA777DEEA782E8B4D7C7C33BBF8A4496
Time:	09:17:36
Date:	05/01/2023
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7c72c0000
Modulesize:	651264
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\taskkill.exe

taskkill /im "SplitFiles131.exe" /f

Details

Is windows:	true
Is dropped:	false
PID:	6076
Target ID:	6
Parent PID:	2264
Name:	taskkill.exe
Path:	C:\Windows\SysWOW64\taskkill.exe
Commandline:	taskkill /im "SplitFiles131.exe" /f
Size:	74752
MD5:	15E2E0ACD891510C6268CB8899F2A1A1
Time:	09:17:36
Date:	05/01/2023
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x1f0000
Modulesize:	86016
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Uses taskkill to terminate processes	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte

45.139.105.171

http://107.182.129.235/storage/extension.php

107.182.129.235

http://107.182.129.235/storage/ping.php

107.182.129.235

http://171.22.30.106/library.php

171.22.30.106

http://www.innosetup.com/

unknown

http://107.182.129.235/storage/extension.php8

unknown

http://www.altarsoft.com/split_files.shtml

unknown

http://www.remobjects.com/?ps

unknown

http://rus.altarsoft.com/split_files.shtml

unknown

http://www.innosetup.com

unknown

http://107.182.129.235ibrary.php

unknown

http://www.innosetup.comDVarFileInfo$

unknown

http://www.remobjects.com/?psU

unknown

There are 3 hidden URLs, click here to show them.

IPs

Domain

Country

Malicious

45.139.105.171

unknown

Italy

Details

IP:	45.139.105.171
TargetID:	2
Current Path:	C:\Program Files (x86)\Split Files\SplitFiles131.exe
Country:	Italy
Countrycode:	ITA
ASN number:	33657
ASN name:	CMCSUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

45.139.105.1

unknown

Italy

Details

IP:	45.139.105.1
TargetID:	255
Country:	Italy
Countrycode:	ITA
ASN number:	33657
ASN name:	CMCSUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
IP address seen in connection with other malware	Networking
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found malware configuration	AV Detection

85.31.46.167

unknown

Germany

Details

IP:	85.31.46.167
TargetID:	255
Country:	Germany
Countrycode:	DEU
ASN number:	43659
ASN name:	CLOUDCOMPUTINGDE
Private:	false

Signature Hits	Behavior Group	Mitre Attack
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Found malware configuration	AV Detection

107.182.129.235

unknown

Reserved

Details

IP:	107.182.129.235
TargetID:	2
Current Path:	C:\Program Files (x86)\Split Files\SplitFiles131.exe
Country:	Reserved
Countrycode:	ZZZ
ASN number:	11070
ASN name:	META-ASUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

171.22.30.106

unknown

Germany

Details

IP:	171.22.30.106
TargetID:	2
Current Path:	C:\Program Files (x86)\Split Files\SplitFiles131.exe
Country:	Germany
Countrycode:	DEU
ASN number:	33657
ASN name:	CMCSUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\Software\Avepoint Software\SplitFiles131

Language