pikabot | 2bf21a583f86c4889b1653cb188aa361a20a9fbaa451d514c4d2d8bf5decc24d

Resubmissions

17/11/2023, 17:23

231117-vydb3acg4v10

17/11/2023, 17:09

231117-vpd71acf2110

17/11/2023, 16:57

231117-vgd72abd4610

17/11/2023, 15:58

231117-tej5tsaf383

Analysis

max time kernel
153s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2023, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VSP.dll
Size 1.2MB
Sample231117-vpd71acf21
SHA256 2bf21a583f86c4889b1653cb188aa361a20a9fbaa451d514c4d2d8bf5decc24d
MD5 1256db0d678a86a604a61dd42da07a4a
SHA1 5ba1f4e06963b726e6a127f2a4caf605c94991d6
SHA512 294a4777fdf76e2e72fa3e544c75967797a924038139a32b79b4456dbda45e15d4d063238a65b0256b9b9393267bfefe4967b54e6a93011a05846a96ed1fcff5
SSDEEP 24576:XDOgwgfYbK9s3kW3CG3vQ3snpR7loatbEUZqHwhv642THJ1r63LSw7b8VzkPPjwt:XDOyfYbK9sZvw8V/qQeHf6JUawknjY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pikabot botnet

Malware Config

Signatures

Detects PikaBot botnet 7 IoCs

resource	yara_rule
behavioral1/memory/4268-6-0x00000000002A0000-0x00000000002EC000-memory.dmp	family_pikabot_v2
behavioral1/memory/4268-8-0x00000000002A0000-0x00000000002EC000-memory.dmp	family_pikabot_v2
behavioral1/memory/4268-9-0x00000000002A0000-0x00000000002EC000-memory.dmp	family_pikabot_v2
behavioral1/memory/4268-10-0x00000000002A0000-0x00000000002EC000-memory.dmp	family_pikabot_v2
behavioral1/memory/4268-11-0x00000000002A0000-0x00000000002EC000-memory.dmp	family_pikabot_v2
behavioral1/memory/4268-12-0x00000000002A0000-0x00000000002EC000-memory.dmp	family_pikabot_v2
behavioral1/memory/4268-15-0x00000000002A0000-0x00000000002EC000-memory.dmp	family_pikabot_v2

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5000 set thread context of 4268	5000	rundll32.exe	107

Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery

T1057

pid	Process
4972	tasklist.exe
560	tasklist.exe
2020	tasklist.exe
1492	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5000	ipconfig.exe
4848	netstat.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4972	tasklist.exe
4972	tasklist.exe
4268	SearchProtocolHost.exe
4268	SearchProtocolHost.exe
560	tasklist.exe
560	tasklist.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5000	rundll32.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	4972	tasklist.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	2300	whoami.exe
Token: SeDebugPrivilege	4848	netstat.exe
Token: SeDebugPrivilege	560	tasklist.exe
Token: SeDebugPrivilege	2020	tasklist.exe
Token: SeDebugPrivilege	1492	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 1708	2112	rundll32.exe	89
PID 2112 wrote to memory of 1708	2112	rundll32.exe	89
PID 2112 wrote to memory of 1708	2112	rundll32.exe	89
PID 4084 wrote to memory of 3948	4084	cmd.exe	104
PID 4084 wrote to memory of 3948	4084	cmd.exe	104
PID 3948 wrote to memory of 5000	3948	rundll32.exe	105
PID 3948 wrote to memory of 5000	3948	rundll32.exe	105
PID 3948 wrote to memory of 5000	3948	rundll32.exe	105
PID 4084 wrote to memory of 4972	4084	cmd.exe	106
PID 4084 wrote to memory of 4972	4084	cmd.exe	106
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107
PID 5000 wrote to memory of 4268	5000	rundll32.exe	107

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VSP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VSP.dll,#1
  2⤵
  PID:1708

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\system32\rundll32.exe
  rundll32 VSP.dll, Crash
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 VSP.dll, Crash
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5000
  - - C:\Windows\SysWOW64\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4268
    - - C:\Windows\SysWOW64\whoami.exe
        
        whoami.exe /all
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig.exe /all
        5⤵
        Gathers network information
        
        PID:5000
    - - C:\Windows\SysWOW64\netstat.exe
        
        netstat.exe -aon
        5⤵
        Gathers network information
        Suspicious use of AdjustPrivilegeToken
        
        PID:4848
- C:\Windows\system32\tasklist.exe
  tasklist /V
  2⤵
  - Enumerates processes with tasklist
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4972
- C:\Windows\system32\tasklist.exe
  tasklist /V
  2⤵
  - Enumerates processes with tasklist
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:560
- C:\Windows\system32\findstr.exe
  findstr /i searchprotocolhost
  2⤵
  PID:3180
- C:\Windows\system32\tasklist.exe
  tasklist /M VSP.dll
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2020
- C:\Windows\system32\tasklist.exe
  tasklist /M VSP*
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4268-6-0x00000000002A0000-0x00000000002EC000-memory.dmp

Download

memory/4268-8-0x00000000002A0000-0x00000000002EC000-memory.dmp

Download

memory/4268-9-0x00000000002A0000-0x00000000002EC000-memory.dmp

Download

memory/4268-10-0x00000000002A0000-0x00000000002EC000-memory.dmp

Download

memory/4268-11-0x00000000002A0000-0x00000000002EC000-memory.dmp

Download

memory/4268-12-0x00000000002A0000-0x00000000002EC000-memory.dmp

Download

memory/4268-15-0x00000000002A0000-0x00000000002EC000-memory.dmp

Download

memory/5000-0-0x0000000002C70000-0x0000000002C73000-memory.dmp

Download

memory/5000-1-0x0000000002EF0000-0x0000000002FC0000-memory.dmp

Download