pikabot | 30db7abf0363af237d64843c95e9bf79f35919e6297f3d5d13acd3a89ab1443f

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2023 06:21

Target

006pikabin.dll
Size

1.3MB
MD5

f582fa17542fc2b5257f8d3e50eb6231
SHA1

5d0c65e44f77da0e9dc42448b6b46d8d64fb40fb
SHA256

30db7abf0363af237d64843c95e9bf79f35919e6297f3d5d13acd3a89ab1443f
SHA512

ee3810d9be76553e640eb80846e0a8de24d9ed64c40e48ced72c8cc43d80874dd8c267a36894b09f62f198f3c05d7ba3f8713e654668be47a99232b23da0d682
SSDEEP

12288:zNfg7ayYgZHRXnW0liwD8L9GlB/TSJRBzfVE/+AqD0eBkvkJl6h4MEFvhAkRoAG5:zRTyV2ZxybQvh9RoOUzux82V8P

Score

10^/10

pikabot botnet

Detects PikaBot botnet 2 IoCs

resource	yara_rule
behavioral2/memory/740-136-0x00000000006A0000-0x00000000006AE000-memory.dmp	family_pikabot
behavioral2/memory/740-140-0x00000000006A0000-0x00000000006AE000-memory.dmp	family_pikabot

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3668 set thread context of 740	3668	rundll32.exe	91

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3668	rundll32.exe
3668	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3668	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 3668	4192	rundll32.exe	84
PID 4192 wrote to memory of 3668	4192	rundll32.exe	84
PID 4192 wrote to memory of 3668	4192	rundll32.exe	84
PID 3668 wrote to memory of 740	3668	rundll32.exe	91
PID 3668 wrote to memory of 740	3668	rundll32.exe	91
PID 3668 wrote to memory of 740	3668	rundll32.exe	91
PID 3668 wrote to memory of 740	3668	rundll32.exe	91
PID 3668 wrote to memory of 740	3668	rundll32.exe	91
PID 3668 wrote to memory of 740	3668	rundll32.exe	91
PID 3668 wrote to memory of 740	3668	rundll32.exe	91
PID 3668 wrote to memory of 740	3668	rundll32.exe	91
PID 3668 wrote to memory of 740	3668	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\006pikabin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\006pikabin.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Windows\SysWOW64\WWAHost.exe
    "C:\Windows\SysWOW64\WWAHost.exe"
    3⤵
    PID:740

memory/740-136-0x00000000006A0000-0x00000000006AE000-memory.dmp

Filesize
56KB

Download
memory/740-140-0x00000000006A0000-0x00000000006AE000-memory.dmp

Filesize
56KB

Download
memory/3668-133-0x00000000022D0000-0x0000000002366000-memory.dmp

Filesize
600KB

Download
memory/3668-134-0x00000000023B0000-0x0000000002424000-memory.dmp

Filesize
464KB

Download
memory/3668-135-0x00000000023B0000-0x0000000002424000-memory.dmp

Filesize
464KB

Download
memory/3668-143-0x00000000023B0000-0x0000000002424000-memory.dmp

Filesize
464KB

Download