pikabot | 30db7abf0363af237d64843c95e9bf79f35919e6297f3d5d13acd3a89ab1443f

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2023 06:21

Target

006pikabin.dll
Size

1.3MB
MD5

f582fa17542fc2b5257f8d3e50eb6231
SHA1

5d0c65e44f77da0e9dc42448b6b46d8d64fb40fb
SHA256

30db7abf0363af237d64843c95e9bf79f35919e6297f3d5d13acd3a89ab1443f
SHA512

ee3810d9be76553e640eb80846e0a8de24d9ed64c40e48ced72c8cc43d80874dd8c267a36894b09f62f198f3c05d7ba3f8713e654668be47a99232b23da0d682
SSDEEP

12288:zNfg7ayYgZHRXnW0liwD8L9GlB/TSJRBzfVE/+AqD0eBkvkJl6h4MEFvhAkRoAG5:zRTyV2ZxybQvh9RoOUzux82V8P

Score

10^/10

pikabot botnet

Detects PikaBot botnet 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/740-136-0x00000000006A0000-0x00000000006AE000-memory.dmp	family_pikabot
behavioral2/memory/740-140-0x00000000006A0000-0x00000000006AE000-memory.dmp	family_pikabot

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 3668 set thread context of 740 3668 rundll32.exe WWAHost.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

3668 rundll32.exe
3668 rundll32.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

rundll32.exe

pid process

3668 rundll32.exe

description	pid	process	target process
PID 3668 set thread context of 740	3668	rundll32.exe	WWAHost.exe

pid	process
3668	rundll32.exe
3668	rundll32.exe

pid	process
3668	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4192 wrote to memory of 3668	4192	rundll32.exe	rundll32.exe
PID 4192 wrote to memory of 3668	4192	rundll32.exe	rundll32.exe
PID 4192 wrote to memory of 3668	4192	rundll32.exe	rundll32.exe
PID 3668 wrote to memory of 740	3668	rundll32.exe	WWAHost.exe
PID 3668 wrote to memory of 740	3668	rundll32.exe	WWAHost.exe
PID 3668 wrote to memory of 740	3668	rundll32.exe	WWAHost.exe
PID 3668 wrote to memory of 740	3668	rundll32.exe	WWAHost.exe
PID 3668 wrote to memory of 740	3668	rundll32.exe	WWAHost.exe
PID 3668 wrote to memory of 740	3668	rundll32.exe	WWAHost.exe
PID 3668 wrote to memory of 740	3668	rundll32.exe	WWAHost.exe
PID 3668 wrote to memory of 740	3668	rundll32.exe	WWAHost.exe
PID 3668 wrote to memory of 740	3668	rundll32.exe	WWAHost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\006pikabin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4192

memory/740-136-0x00000000006A0000-0x00000000006AE000-memory.dmp

Filesize
56KB

Download
memory/740-140-0x00000000006A0000-0x00000000006AE000-memory.dmp

Filesize
56KB

Download
memory/3668-133-0x00000000022D0000-0x0000000002366000-memory.dmp

Filesize
600KB

Download
memory/3668-134-0x00000000023B0000-0x0000000002424000-memory.dmp

Filesize
464KB

Download
memory/3668-135-0x00000000023B0000-0x0000000002424000-memory.dmp

Filesize
464KB

Download
memory/3668-143-0x00000000023B0000-0x0000000002424000-memory.dmp

Filesize
464KB

Download