Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2023 16:07
Static task
static1
Behavioral task
behavioral1
Sample
RIRS.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
RIRS.dll
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
launcher.bat
Resource
win7-20231020-en
General
-
Target
launcher.bat
-
Size
58B
-
MD5
f627a4b4c2c27385f8f82152aa576808
-
SHA1
a8d71fc8958dda6dea7165c46721061bd659da81
-
SHA256
4f2b4b4a37ccd633ee482dba7190ef279d53d103cdb14bbf1d0cf3cf60cc2a1f
-
SHA512
e9c1a0f88ad85199f63224142c35309fb0a15ae3d696706f8eece9e0026533068351fe8d7f3f9ea928ef590ac71c9bf81f887c70a214d3236271b7e01aba1e2b
Malware Config
Signatures
-
Detects PikaBot botnet 6 IoCs
Processes:
resource yara_rule behavioral4/memory/2940-6-0x0000000000C60000-0x0000000000CAF000-memory.dmp family_pikabot_v2 behavioral4/memory/2940-8-0x0000000000C60000-0x0000000000CAF000-memory.dmp family_pikabot_v2 behavioral4/memory/2940-9-0x0000000000C60000-0x0000000000CAF000-memory.dmp family_pikabot_v2 behavioral4/memory/2940-11-0x0000000000C60000-0x0000000000CAF000-memory.dmp family_pikabot_v2 behavioral4/memory/2940-14-0x0000000000C60000-0x0000000000CAF000-memory.dmp family_pikabot_v2 behavioral4/memory/2940-15-0x0000000000C60000-0x0000000000CAF000-memory.dmp family_pikabot_v2 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1156 set thread context of 2940 1156 rundll32.exe SearchProtocolHost.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exenetstat.exepid process 2900 ipconfig.exe 3544 netstat.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 2964 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SearchProtocolHost.exepid process 2940 SearchProtocolHost.exe 2940 SearchProtocolHost.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
Processes:
rundll32.exepid process 1156 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
Processes:
whoami.exenetstat.exedescription pid process Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 1920 whoami.exe Token: SeDebugPrivilege 3544 netstat.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exerundll32.exerundll32.exedescription pid process target process PID 2144 wrote to memory of 4836 2144 cmd.exe rundll32.exe PID 2144 wrote to memory of 4836 2144 cmd.exe rundll32.exe PID 4836 wrote to memory of 1156 4836 rundll32.exe rundll32.exe PID 4836 wrote to memory of 1156 4836 rundll32.exe rundll32.exe PID 4836 wrote to memory of 1156 4836 rundll32.exe rundll32.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe PID 1156 wrote to memory of 2940 1156 rundll32.exe SearchProtocolHost.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\launcher.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe RIRS.dll,Excpt2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe RIRS.dll,Excpt3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\whoami.exewhoami.exe /all5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exeipconfig.exe /all5⤵
- Gathers network information
-
C:\Windows\SysWOW64\netstat.exenetstat.exe -aon5⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\NOTEPAD.EXE"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\launcher.bat1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1156-0-0x0000000002A50000-0x0000000002A53000-memory.dmpFilesize
12KB
-
memory/1156-1-0x0000000002E00000-0x0000000002ED2000-memory.dmpFilesize
840KB
-
memory/2940-6-0x0000000000C60000-0x0000000000CAF000-memory.dmpFilesize
316KB
-
memory/2940-8-0x0000000000C60000-0x0000000000CAF000-memory.dmpFilesize
316KB
-
memory/2940-9-0x0000000000C60000-0x0000000000CAF000-memory.dmpFilesize
316KB
-
memory/2940-11-0x0000000000C60000-0x0000000000CAF000-memory.dmpFilesize
316KB
-
memory/2940-14-0x0000000000C60000-0x0000000000CAF000-memory.dmpFilesize
316KB
-
memory/2940-15-0x0000000000C60000-0x0000000000CAF000-memory.dmpFilesize
316KB