Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2023 19:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Plumulaceous.dll
Resource
win7-20231025-en
windows7-x64
1 signatures
150 seconds
General
-
Target
Plumulaceous.dll
-
Size
795KB
-
MD5
c83fe58088ef5f05342367e71eb28873
-
SHA1
8af8c027cb0f56b6775115383f4d5bdf010a6352
-
SHA256
fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128
-
SHA512
0089a1ed148c7ea705ef9bdcaa3231ebf8d78d6e5e32a487ad4dff5aebcae33470aa1c5074d6ed55d7be37ae80526d826a1ce1c93faa6f7181848f0a0d23292d
-
SSDEEP
24576:/tR2jQOoVmT/QrwFbxE6Elpq5nOkcJofEXmi:1TMT/jb+Bl05nBcJocXmi
Malware Config
Signatures
-
Detects PikaBot botnet 6 IoCs
resource yara_rule behavioral2/memory/4208-0-0x0000000000710000-0x000000000075F000-memory.dmp family_pikabot_v2 behavioral2/memory/4208-2-0x0000000000710000-0x000000000075F000-memory.dmp family_pikabot_v2 behavioral2/memory/4208-3-0x0000000000710000-0x000000000075F000-memory.dmp family_pikabot_v2 behavioral2/memory/4208-4-0x0000000000710000-0x000000000075F000-memory.dmp family_pikabot_v2 behavioral2/memory/4208-5-0x0000000000710000-0x000000000075F000-memory.dmp family_pikabot_v2 behavioral2/memory/4208-7-0x0000000000710000-0x000000000075F000-memory.dmp family_pikabot_v2 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3616 set thread context of 4208 3616 rundll32.exe 87 -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1412 ipconfig.exe 3940 netstat.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4208 SearchProtocolHost.exe 4208 SearchProtocolHost.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 3616 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 4036 whoami.exe Token: SeDebugPrivilege 3940 netstat.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4532 wrote to memory of 3616 4532 rundll32.exe 83 PID 4532 wrote to memory of 3616 4532 rundll32.exe 83 PID 4532 wrote to memory of 3616 4532 rundll32.exe 83 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87 PID 3616 wrote to memory of 4208 3616 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Plumulaceous.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Plumulaceous.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4208 -
C:\Windows\SysWOW64\whoami.exewhoami.exe /all4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4036
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig.exe /all4⤵
- Gathers network information
PID:1412
-
-
C:\Windows\SysWOW64\netstat.exenetstat.exe -aon4⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:3940
-
-
-