Analysis
-
max time kernel
298s -
max time network
305s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
31-10-2023 03:33
Static task
static1
General
-
Target
Y98.dlld.dll
-
Size
3.8MB
-
MD5
51967a61a0b543123e281a654aec3879
-
SHA1
d1c306c401976b57c41c2a6ae205fdad114a30bc
-
SHA256
fe3221dba8fc8959279f6cc2aa4b8ad695f69176f81094a4562ac271d4810f31
-
SHA512
1a2d65a29953c657de03041946e3b7302928fa2ef361593c68eddc7e0fdc966fa563200e0c615d06b60caa2912b131136d76ddabbc10fe785a9499829c40eaad
-
SSDEEP
98304:ROpUerIHzl1QEfGMFWF9A2t0PQ3PrcS/5n44:Rve0fQEfrjPa/44
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/716-6-0x0000000000D50000-0x0000000000D9C000-memory.dmp pikabot_core behavioral1/memory/716-8-0x0000000000D50000-0x0000000000D9C000-memory.dmp pikabot_core behavioral1/memory/716-9-0x0000000000D50000-0x0000000000D9C000-memory.dmp pikabot_core behavioral1/memory/716-10-0x0000000000D50000-0x0000000000D9C000-memory.dmp pikabot_core behavioral1/memory/716-11-0x0000000000D50000-0x0000000000D9C000-memory.dmp pikabot_core behavioral1/memory/716-13-0x0000000000D50000-0x0000000000D9C000-memory.dmp pikabot_core -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 2896 set thread context of 716 2896 rundll32.exe SearchProtocolHost.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exenetstat.exepid process 4644 ipconfig.exe 2896 netstat.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SearchProtocolHost.exepid process 716 SearchProtocolHost.exe 716 SearchProtocolHost.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
Processes:
rundll32.exepid process 2896 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes:
whoami.exenetstat.exesvchost.exedescription pid process Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 3892 whoami.exe Token: SeDebugPrivilege 2896 netstat.exe Token: SeManageVolumePrivilege 4748 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 4524 wrote to memory of 2896 4524 rundll32.exe rundll32.exe PID 4524 wrote to memory of 2896 4524 rundll32.exe rundll32.exe PID 4524 wrote to memory of 2896 4524 rundll32.exe rundll32.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe PID 2896 wrote to memory of 716 2896 rundll32.exe SearchProtocolHost.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Y98.dlld.dll, Crash1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Y98.dlld.dll, Crash2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\whoami.exewhoami.exe /all4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exeipconfig.exe /all4⤵
- Gathers network information
-
C:\Windows\SysWOW64\netstat.exenetstat.exe -aon4⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfmFilesize
16KB
MD5242feffac1d02e5d8d472516f9486081
SHA13ef512e9476f8386cf526acb1ffd07053ea7cdbd
SHA2564608750b5c47e6f7e0cc7c2bbeecd65bd774ccccfb8bd28cb3c8a57742183933
SHA512cd95c3a151636d776400625674fdcb71e4458a1cd144e417c1a2f9e421924c08ec1be08355828087f9fc32a0e498f6f984b16e225b3d201c984473a00049e6b1
-
memory/716-6-0x0000000000D50000-0x0000000000D9C000-memory.dmpFilesize
304KB
-
memory/716-8-0x0000000000D50000-0x0000000000D9C000-memory.dmpFilesize
304KB
-
memory/716-9-0x0000000000D50000-0x0000000000D9C000-memory.dmpFilesize
304KB
-
memory/716-10-0x0000000000D50000-0x0000000000D9C000-memory.dmpFilesize
304KB
-
memory/716-11-0x0000000000D50000-0x0000000000D9C000-memory.dmpFilesize
304KB
-
memory/716-13-0x0000000000D50000-0x0000000000D9C000-memory.dmpFilesize
304KB
-
memory/2896-0-0x0000000000D00000-0x0000000000D03000-memory.dmpFilesize
12KB
-
memory/2896-1-0x0000000010000000-0x00000000100CF000-memory.dmpFilesize
828KB
-
memory/4748-50-0x00000270174C0000-0x00000270174C1000-memory.dmpFilesize
4KB
-
memory/4748-56-0x00000270174C0000-0x00000270174C1000-memory.dmpFilesize
4KB
-
memory/4748-49-0x00000270174C0000-0x00000270174C1000-memory.dmpFilesize
4KB
-
memory/4748-32-0x000002700EF40000-0x000002700EF50000-memory.dmpFilesize
64KB
-
memory/4748-51-0x00000270174C0000-0x00000270174C1000-memory.dmpFilesize
4KB
-
memory/4748-52-0x00000270174C0000-0x00000270174C1000-memory.dmpFilesize
4KB
-
memory/4748-53-0x00000270174C0000-0x00000270174C1000-memory.dmpFilesize
4KB
-
memory/4748-54-0x00000270174C0000-0x00000270174C1000-memory.dmpFilesize
4KB
-
memory/4748-55-0x00000270174C0000-0x00000270174C1000-memory.dmpFilesize
4KB
-
memory/4748-48-0x00000270174A0000-0x00000270174A1000-memory.dmpFilesize
4KB
-
memory/4748-57-0x00000270174C0000-0x00000270174C1000-memory.dmpFilesize
4KB
-
memory/4748-58-0x00000270174C0000-0x00000270174C1000-memory.dmpFilesize
4KB
-
memory/4748-59-0x0000027017100000-0x0000027017101000-memory.dmpFilesize
4KB
-
memory/4748-60-0x00000270170F0000-0x00000270170F1000-memory.dmpFilesize
4KB
-
memory/4748-62-0x0000027017100000-0x0000027017101000-memory.dmpFilesize
4KB
-
memory/4748-65-0x00000270170F0000-0x00000270170F1000-memory.dmpFilesize
4KB
-
memory/4748-68-0x000002700E7E0000-0x000002700E7E1000-memory.dmpFilesize
4KB
-
memory/4748-16-0x000002700EE40000-0x000002700EE50000-memory.dmpFilesize
64KB