Analysis

  • max time kernel
    146s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-11-2023 10:56

General

  • Target

    launcher.bat

  • Size

    62B

  • MD5

    ca26c2116e48ff8168a0dfea335e0ba7

  • SHA1

    ad430bfff4a4b47bc7b62786bf117fa8e26440f9

  • SHA256

    acc454e4126e9809f4e44f13bf28eaeb20deab377182b579a11fcfbc480da50a

  • SHA512

    dae2de54f44777203714deecf057a79ce1e24b446985bea7126f8bc020b64b5c8e17df6a8c27502081b21ee93a4ed9eef05103f73260390de7756b7a6eab7fab

Score
10/10

Malware Config

Signatures

  • PikaBot

    PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.

  • Suspicious use of SetThreadContext 1 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\launcher.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3088
    • C:\Windows\system32\rundll32.exe
      rundll32.exe 17112023_2229_Anesthesiology.dll,Throw
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1000
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe 17112023_2229_Anesthesiology.dll,Throw
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        PID:4860
        • C:\Windows\SysWOW64\SearchProtocolHost.exe
          "C:\Windows\System32\SearchProtocolHost.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3568
          • C:\Windows\SysWOW64\whoami.exe
            whoami.exe /all
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3456
          • C:\Windows\SysWOW64\ipconfig.exe
            ipconfig.exe /all
            5⤵
            • Gathers network information
            PID:4944
          • C:\Windows\SysWOW64\netstat.exe
            netstat.exe -aon
            5⤵
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:2996

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3568-6-0x0000000000E10000-0x0000000000E5E000-memory.dmp

    Filesize

    312KB

  • memory/3568-8-0x0000000000E10000-0x0000000000E5E000-memory.dmp

    Filesize

    312KB

  • memory/3568-9-0x0000000000E10000-0x0000000000E5E000-memory.dmp

    Filesize

    312KB

  • memory/3568-10-0x0000000000E10000-0x0000000000E5E000-memory.dmp

    Filesize

    312KB

  • memory/3568-13-0x0000000000E10000-0x0000000000E5E000-memory.dmp

    Filesize

    312KB

  • memory/4860-0-0x0000000002A70000-0x0000000002A73000-memory.dmp

    Filesize

    12KB

  • memory/4860-1-0x0000000010000000-0x00000000100CB000-memory.dmp

    Filesize

    812KB