Resubmissions
17-11-2023 17:23
231117-vydb3acg4v 1017-11-2023 17:09
231117-vpd71acf21 1017-11-2023 16:57
231117-vgd72abd46 1017-11-2023 15:58
231117-tej5tsaf38 3Analysis
-
max time kernel
297s -
max time network
266s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
17-11-2023 16:57
Static task
static1
1 signatures
General
-
Target
VSP.dll
-
Size
1.2MB
-
MD5
1256db0d678a86a604a61dd42da07a4a
-
SHA1
5ba1f4e06963b726e6a127f2a4caf605c94991d6
-
SHA256
2bf21a583f86c4889b1653cb188aa361a20a9fbaa451d514c4d2d8bf5decc24d
-
SHA512
294a4777fdf76e2e72fa3e544c75967797a924038139a32b79b4456dbda45e15d4d063238a65b0256b9b9393267bfefe4967b54e6a93011a05846a96ed1fcff5
-
SSDEEP
24576:XDOgwgfYbK9s3kW3CG3vQ3snpR7loatbEUZqHwhv642THJ1r63LSw7b8VzkPPjwt:XDOyfYbK9sZvw8V/qQeHf6JUawknjY
Malware Config
Signatures
-
Detects PikaBot botnet 10 IoCs
Processes:
resource yara_rule behavioral1/memory/4104-6-0x0000000000560000-0x00000000005AC000-memory.dmp family_pikabot_v2 behavioral1/memory/4104-8-0x0000000000560000-0x00000000005AC000-memory.dmp family_pikabot_v2 behavioral1/memory/4104-9-0x0000000000560000-0x00000000005AC000-memory.dmp family_pikabot_v2 behavioral1/memory/4104-10-0x0000000000560000-0x00000000005AC000-memory.dmp family_pikabot_v2 behavioral1/memory/4104-11-0x0000000000560000-0x00000000005AC000-memory.dmp family_pikabot_v2 behavioral1/memory/4104-12-0x0000000000560000-0x00000000005AC000-memory.dmp family_pikabot_v2 behavioral1/memory/4104-13-0x0000000000560000-0x00000000005AC000-memory.dmp family_pikabot_v2 behavioral1/memory/4104-15-0x0000000000560000-0x00000000005AC000-memory.dmp family_pikabot_v2 behavioral1/memory/4104-26-0x0000000000560000-0x00000000005AC000-memory.dmp family_pikabot_v2 behavioral1/memory/4104-29-0x0000000000560000-0x00000000005AC000-memory.dmp family_pikabot_v2 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1880 set thread context of 4104 1880 rundll32.exe SearchProtocolHost.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exenetstat.exepid process 1756 ipconfig.exe 2252 netstat.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SearchProtocolHost.exepid process 4104 SearchProtocolHost.exe 4104 SearchProtocolHost.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
Processes:
rundll32.exepid process 1880 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes:
tasklist.exewhoami.exenetstat.exedescription pid process Token: SeDebugPrivilege 416 tasklist.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 3316 whoami.exe Token: SeDebugPrivilege 2252 netstat.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.execmd.exerundll32.exerundll32.exedescription pid process target process PID 2968 wrote to memory of 4992 2968 rundll32.exe rundll32.exe PID 2968 wrote to memory of 4992 2968 rundll32.exe rundll32.exe PID 2968 wrote to memory of 4992 2968 rundll32.exe rundll32.exe PID 1896 wrote to memory of 5084 1896 cmd.exe rundll32.exe PID 1896 wrote to memory of 5084 1896 cmd.exe rundll32.exe PID 5084 wrote to memory of 1880 5084 rundll32.exe rundll32.exe PID 5084 wrote to memory of 1880 5084 rundll32.exe rundll32.exe PID 5084 wrote to memory of 1880 5084 rundll32.exe rundll32.exe PID 1896 wrote to memory of 416 1896 cmd.exe tasklist.exe PID 1896 wrote to memory of 416 1896 cmd.exe tasklist.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe PID 1880 wrote to memory of 4104 1880 rundll32.exe SearchProtocolHost.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\VSP.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\VSP.dll,#12⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32 VSP.dll, Crash2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32 VSP.dll, Crash3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\whoami.exewhoami.exe /all5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exeipconfig.exe /all5⤵
- Gathers network information
-
C:\Windows\SysWOW64\netstat.exenetstat.exe -aon5⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1880-0-0x0000000002040000-0x0000000002043000-memory.dmpFilesize
12KB
-
memory/1880-1-0x0000000002390000-0x0000000002460000-memory.dmpFilesize
832KB
-
memory/4104-6-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/4104-8-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/4104-9-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/4104-10-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/4104-11-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/4104-12-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/4104-13-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/4104-15-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/4104-26-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB
-
memory/4104-29-0x0000000000560000-0x00000000005AC000-memory.dmpFilesize
304KB