Analysis
-
max time kernel
308s -
max time network
273s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2023 16:40
Static task
static1
General
-
Target
forecounsel.dll
-
Size
2.1MB
-
MD5
a6d4a12f1c3c1d68ac3483f546144328
-
SHA1
e5bccdd808c66f618cdb02246be76506eb5dda06
-
SHA256
b6fc374e778c7abe998f4318b17dc4085885a81fe633da51581285fa2c46ec73
-
SHA512
7c56824ab0fb1107826e2e9baac1d0b4808a791bbce48d6c8b2da1525b8e0d7770c6e3432ac47e8e2d3df22881cad56e4d38dde64bdbef37bd9d7be3162b30d3
-
SSDEEP
49152:4zdqXJqxcLD0YvMf/HyUZwnYVFQkcCZLoCWtZqPpu:4YUxqD0CINmnYVFQkcCZLoxtZqPp
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2772-1-0x0000000000B00000-0x0000000000B53000-memory.dmp pikabot_core behavioral1/memory/2772-3-0x0000000000B00000-0x0000000000B53000-memory.dmp pikabot_core behavioral1/memory/2772-4-0x0000000000B00000-0x0000000000B53000-memory.dmp pikabot_core behavioral1/memory/2772-6-0x0000000000B00000-0x0000000000B53000-memory.dmp pikabot_core behavioral1/memory/2772-7-0x0000000000B00000-0x0000000000B53000-memory.dmp pikabot_core behavioral1/memory/2772-8-0x0000000000B00000-0x0000000000B53000-memory.dmp pikabot_core behavioral1/memory/2772-9-0x0000000000B00000-0x0000000000B53000-memory.dmp pikabot_core behavioral1/memory/2772-10-0x0000000000B00000-0x0000000000B53000-memory.dmp pikabot_core behavioral1/memory/2772-11-0x0000000000B00000-0x0000000000B53000-memory.dmp pikabot_core behavioral1/memory/2772-12-0x0000000000B00000-0x0000000000B53000-memory.dmp pikabot_core behavioral1/memory/2772-24-0x0000000000B00000-0x0000000000B53000-memory.dmp pikabot_core -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 4828 set thread context of 2772 4828 rundll32.exe SearchProtocolHost.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exenetstat.exepid process 4744 ipconfig.exe 2528 netstat.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SearchProtocolHost.exepid process 2772 SearchProtocolHost.exe 2772 SearchProtocolHost.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
Processes:
rundll32.exepid process 4828 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
Processes:
whoami.exenetstat.exedescription pid process Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 1396 whoami.exe Token: SeDebugPrivilege 2528 netstat.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3896 wrote to memory of 4828 3896 rundll32.exe rundll32.exe PID 3896 wrote to memory of 4828 3896 rundll32.exe rundll32.exe PID 3896 wrote to memory of 4828 3896 rundll32.exe rundll32.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe PID 4828 wrote to memory of 2772 4828 rundll32.exe SearchProtocolHost.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\forecounsel.dll, Excpt1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\forecounsel.dll, Excpt2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\whoami.exewhoami.exe /all4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exeipconfig.exe /all4⤵
- Gathers network information
-
C:\Windows\SysWOW64\netstat.exenetstat.exe -aon4⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2772-7-0x0000000000B00000-0x0000000000B53000-memory.dmpFilesize
332KB
-
memory/2772-1-0x0000000000B00000-0x0000000000B53000-memory.dmpFilesize
332KB
-
memory/2772-3-0x0000000000B00000-0x0000000000B53000-memory.dmpFilesize
332KB
-
memory/2772-4-0x0000000000B00000-0x0000000000B53000-memory.dmpFilesize
332KB
-
memory/2772-6-0x0000000000B00000-0x0000000000B53000-memory.dmpFilesize
332KB
-
memory/2772-8-0x0000000000B00000-0x0000000000B53000-memory.dmpFilesize
332KB
-
memory/2772-9-0x0000000000B00000-0x0000000000B53000-memory.dmpFilesize
332KB
-
memory/2772-10-0x0000000000B00000-0x0000000000B53000-memory.dmpFilesize
332KB
-
memory/2772-11-0x0000000000B00000-0x0000000000B53000-memory.dmpFilesize
332KB
-
memory/2772-12-0x0000000000B00000-0x0000000000B53000-memory.dmpFilesize
332KB
-
memory/2772-24-0x0000000000B00000-0x0000000000B53000-memory.dmpFilesize
332KB
-
memory/4828-5-0x0000000002620000-0x00000000026F2000-memory.dmpFilesize
840KB
-
memory/4828-0-0x0000000002620000-0x00000000026F2000-memory.dmpFilesize
840KB