Analysis
- max time kernel
142s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20231020-en - resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system - submitted
21/11/2023, 12:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
document.docx.lnk
Resource
win7-20231020-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
document.docx.lnk
Resource
win10v2004-20231020-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
inf2.dll
Resource
win7-20231023-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
inf2.dll
Resource
win10v2004-20231023-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target document.docx.lnk
- Size 1KB
- Sample231121-pbfwsaec72
- SHA256 4c267d4f7155d7f0686d1ac2ea861eaa926fd41a9d71e8f6952caf24492b376b
- MD5 1b8361e2f1b058a9791047dce0df57c4
- SHA1 3cd3750507971e8f9eef55249e5b2646855652c6
- SHA512 c084582e40cc3739e08677b6523c355a297185d37747f853b363c1e0053ca3c753ee4b6b86d3d89f72dfbdae8b4805d63a0223f9e371bcc6bddc9fd053eea77c
- MD5 SHA1 SHA512
Malware Config
Signatures
- Detects PikaBot botnet 6 IoCs
resource yara_rule behavioral2/memory/3120-6-0x0000000000FC0000-0x000000000100F000-memory.dmp family_pikabot_v2 behavioral2/memory/3120-8-0x0000000000FC0000-0x000000000100F000-memory.dmp family_pikabot_v2 behavioral2/memory/3120-9-0x0000000000FC0000-0x000000000100F000-memory.dmp family_pikabot_v2 behavioral2/memory/3120-10-0x0000000000FC0000-0x000000000100F000-memory.dmp family_pikabot_v2 behavioral2/memory/3120-11-0x0000000000FC0000-0x000000000100F000-memory.dmp family_pikabot_v2 behavioral2/memory/3120-13-0x0000000000FC0000-0x000000000100F000-memory.dmp family_pikabot_v2 - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation cmd.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4008 set thread context of 3120 4008 rundll32.exe 94 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4600 ipconfig.exe 4860 netstat.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3120 SearchProtocolHost.exe 3120 SearchProtocolHost.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 4008 rundll32.exe - Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 3772 whoami.exe Token: SeDebugPrivilege 4860 netstat.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1920 wrote to memory of 3740 1920 cmd.exe 84 PID 1920 wrote to memory of 3740 1920 cmd.exe 84 PID 3740 wrote to memory of 4008 3740 rundll32.exe 85 PID 3740 wrote to memory of 4008 3740 rundll32.exe 85 PID 3740 wrote to memory of 4008 3740 rundll32.exe 85 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94 PID 4008 wrote to memory of 3120 4008 rundll32.exe 94
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\document.docx.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" inf2.dll,Limit2⤵
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" inf2.dll,Limit3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3120 -
C:\Windows\SysWOW64\whoami.exewhoami.exe /all5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3772
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig.exe /all5⤵
- Gathers network information
PID:4600
-
-
C:\Windows\SysWOW64\netstat.exenetstat.exe -aon5⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:4860
-
-
-
-