pikabot | 30db7abf0363af237d64843c95e9bf79f35919e6297f3d5d13acd3a89ab1443f

Analysis

max time kernel
83s
max time network
91s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2023 21:53

Target

006-pika.dll
Size

1.3MB
MD5

f582fa17542fc2b5257f8d3e50eb6231
SHA1

5d0c65e44f77da0e9dc42448b6b46d8d64fb40fb
SHA256

30db7abf0363af237d64843c95e9bf79f35919e6297f3d5d13acd3a89ab1443f
SHA512

ee3810d9be76553e640eb80846e0a8de24d9ed64c40e48ced72c8cc43d80874dd8c267a36894b09f62f198f3c05d7ba3f8713e654668be47a99232b23da0d682
SSDEEP

12288:zNfg7ayYgZHRXnW0liwD8L9GlB/TSJRBzfVE/+AqD0eBkvkJl6h4MEFvhAkRoAG5:zRTyV2ZxybQvh9RoOUzux82V8P

Score

10^/10

pikabot botnet

Detects PikaBot botnet 2 IoCs

resource	yara_rule
behavioral2/memory/2944-136-0x0000000000E30000-0x0000000000E3E000-memory.dmp	family_pikabot
behavioral2/memory/2944-140-0x0000000000E30000-0x0000000000E3E000-memory.dmp	family_pikabot

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4208 set thread context of 2944	4208	rundll32.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4208	rundll32.exe
4208	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4208	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 4208	2192	rundll32.exe	83
PID 2192 wrote to memory of 4208	2192	rundll32.exe	83
PID 2192 wrote to memory of 4208	2192	rundll32.exe	83
PID 4208 wrote to memory of 2944	4208	rundll32.exe	90
PID 4208 wrote to memory of 2944	4208	rundll32.exe	90
PID 4208 wrote to memory of 2944	4208	rundll32.exe	90
PID 4208 wrote to memory of 2944	4208	rundll32.exe	90
PID 4208 wrote to memory of 2944	4208	rundll32.exe	90
PID 4208 wrote to memory of 2944	4208	rundll32.exe	90
PID 4208 wrote to memory of 2944	4208	rundll32.exe	90
PID 4208 wrote to memory of 2944	4208	rundll32.exe	90
PID 4208 wrote to memory of 2944	4208	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\006-pika.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\006-pika.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\SysWOW64\WWAHost.exe
    "C:\Windows\SysWOW64\WWAHost.exe"
    3⤵
    PID:2944

memory/2944-136-0x0000000000E30000-0x0000000000E3E000-memory.dmp

Filesize
56KB

Download
memory/2944-140-0x0000000000E30000-0x0000000000E3E000-memory.dmp

Filesize
56KB

Download
memory/4208-133-0x0000000002450000-0x00000000024E6000-memory.dmp

Filesize
600KB

Download
memory/4208-134-0x00000000024F0000-0x0000000002564000-memory.dmp

Filesize
464KB

Download
memory/4208-135-0x00000000024F0000-0x0000000002564000-memory.dmp

Filesize
464KB

Download