pikabot | 8706238594e89688a27279cc2148a0da409da6108aea7f193a7355a318c063a2

General

Target

launcher.bat
Size

78B
MD5

b798e505cab8b4485e6564c2ebe7ca9a
SHA1

dcae7a12511993699e426df80c6a685f0b516d49
SHA256

6c09f67e986a895de62234143490469fcc8bc393c4cc5e8d58346ea5e6f77395
SHA512

9743066cbd1ce7d2795dfbe97ad268258fadd7846bbd9e3ccd25db613d11653fabfd7c1501becad4a5bae332629e8275cedbdd292584ac856770b57d581100bb

Score

10^/10

pikabot botnet

Malware Config

Signatures

Detects PikaBot botnet 6 IoCs

Processes:

resource	yara_rule
behavioral4/memory/1140-7-0x0000000000840000-0x0000000000891000-memory.dmp	family_pikabot_v2
behavioral4/memory/1140-9-0x0000000000840000-0x0000000000891000-memory.dmp	family_pikabot_v2
behavioral4/memory/1140-10-0x0000000000840000-0x0000000000891000-memory.dmp	family_pikabot_v2
behavioral4/memory/1140-12-0x0000000000840000-0x0000000000891000-memory.dmp	family_pikabot_v2
behavioral4/memory/1140-13-0x0000000000840000-0x0000000000891000-memory.dmp	family_pikabot_v2
behavioral4/memory/1140-16-0x0000000000840000-0x0000000000891000-memory.dmp	family_pikabot_v2

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 748 set thread context of 1140 748 rundll32.exe SearchProtocolHost.exe
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exenetstat.exe

pid process

2984 ipconfig.exe
1904 netstat.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SearchProtocolHost.exe

pid process

1140 SearchProtocolHost.exe
1140 SearchProtocolHost.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

748 rundll32.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

rundll32.exe

pid process

748 rundll32.exe

description	pid	process	target process
PID 748 set thread context of 1140	748	rundll32.exe	SearchProtocolHost.exe

pid	process
2984	ipconfig.exe
1904	netstat.exe

pid	process
1140	SearchProtocolHost.exe
1140	SearchProtocolHost.exe

pid	process
748	rundll32.exe

pid	process
748	rundll32.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

Processes:

whoami.exenetstat.exe

description	pid	process
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	3868	whoami.exe
Token: SeDebugPrivilege	1904	netstat.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exerundll32.exerundll32.exe

description	pid	process	target process
PID 408 wrote to memory of 4584	408	cmd.exe	rundll32.exe
PID 408 wrote to memory of 4584	408	cmd.exe	rundll32.exe
PID 4584 wrote to memory of 748	4584	rundll32.exe	rundll32.exe
PID 4584 wrote to memory of 748	4584	rundll32.exe	rundll32.exe
PID 4584 wrote to memory of 748	4584	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe
PID 748 wrote to memory of 1140	748	rundll32.exe	SearchProtocolHost.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\launcher.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\system32\rundll32.exe
  rundll32.exe AlmiqueArtilleryman_pkb.dll, Throw
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe AlmiqueArtilleryman_pkb.dll, Throw
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:748
  - - C:\Windows\SysWOW64\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1140
    - - C:\Windows\SysWOW64\whoami.exe
        
        whoami.exe /all
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3868
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig.exe /all
        5⤵
        Gathers network information
        
        PID:2984
    - - C:\Windows\SysWOW64\netstat.exe
        
        netstat.exe -aon
        5⤵
        Gathers network information
        Suspicious use of AdjustPrivilegeToken
        
        PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-0-0x0000000000FD0000-0x0000000000FD3000-memory.dmp

Filesize
12KB

Download
memory/748-1-0x0000000010000000-0x00000000100C7000-memory.dmp

Filesize
796KB

Download
memory/748-6-0x000000006FC80000-0x000000006FDD5000-memory.dmp

Filesize
1.3MB

Download
memory/1140-7-0x0000000000840000-0x0000000000891000-memory.dmp

Filesize
324KB

Download
memory/1140-9-0x0000000000840000-0x0000000000891000-memory.dmp

Filesize
324KB

Download
memory/1140-10-0x0000000000840000-0x0000000000891000-memory.dmp

Filesize
324KB

Download
memory/1140-12-0x0000000000840000-0x0000000000891000-memory.dmp

Filesize
324KB

Download
memory/1140-13-0x0000000000840000-0x0000000000891000-memory.dmp

Filesize
324KB

Download
memory/1140-16-0x0000000000840000-0x0000000000891000-memory.dmp

Filesize
324KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads