Analysis
- max time kernel
148s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20231023-en - resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system - submitted
21/11/2023, 11:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
document.docx.lnk
Resource
win7-20231023-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
document.docx.lnk
Resource
win10v2004-20231023-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
inf2.dll
Resource
win7-20231020-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
inf2.dll
Resource
win10v2004-20231023-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target document.docx.lnk
- Size 1KB
- Sample231121-n1cd8aeb97
- SHA256 4c267d4f7155d7f0686d1ac2ea861eaa926fd41a9d71e8f6952caf24492b376b
- MD5 1b8361e2f1b058a9791047dce0df57c4
- SHA1 3cd3750507971e8f9eef55249e5b2646855652c6
- SHA512 c084582e40cc3739e08677b6523c355a297185d37747f853b363c1e0053ca3c753ee4b6b86d3d89f72dfbdae8b4805d63a0223f9e371bcc6bddc9fd053eea77c
- MD5 SHA1 SHA512
Malware Config
Signatures
- Detects PikaBot botnet 5 IoCs
resource yara_rule behavioral2/memory/2380-6-0x0000000000BF0000-0x0000000000C3F000-memory.dmp family_pikabot_v2 behavioral2/memory/2380-8-0x0000000000BF0000-0x0000000000C3F000-memory.dmp family_pikabot_v2 behavioral2/memory/2380-9-0x0000000000BF0000-0x0000000000C3F000-memory.dmp family_pikabot_v2 behavioral2/memory/2380-10-0x0000000000BF0000-0x0000000000C3F000-memory.dmp family_pikabot_v2 behavioral2/memory/2380-13-0x0000000000BF0000-0x0000000000C3F000-memory.dmp family_pikabot_v2 - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation cmd.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2716 set thread context of 2380 2716 rundll32.exe 99 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 5028 ipconfig.exe 4844 netstat.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2380 SearchProtocolHost.exe 2380 SearchProtocolHost.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 2716 rundll32.exe - Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 2608 whoami.exe Token: SeDebugPrivilege 4844 netstat.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3860 wrote to memory of 660 3860 cmd.exe 87 PID 3860 wrote to memory of 660 3860 cmd.exe 87 PID 660 wrote to memory of 2716 660 rundll32.exe 88 PID 660 wrote to memory of 2716 660 rundll32.exe 88 PID 660 wrote to memory of 2716 660 rundll32.exe 88 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99 PID 2716 wrote to memory of 2380 2716 rundll32.exe 99
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\document.docx.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" inf2.dll,Limit2⤵
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" inf2.dll,Limit3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2380 -
C:\Windows\SysWOW64\whoami.exewhoami.exe /all5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig.exe /all5⤵
- Gathers network information
PID:5028
-
-
C:\Windows\SysWOW64\netstat.exenetstat.exe -aon5⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:4844
-
-
-
-