pikabot | 5384e7de6b8d95a7df1d841b7a6a77e3f9418fcda9851e2b120a10019222047c

General

Target

pikabot_unpack.dll
Size

840KB
MD5

5136d5a4242e220ec1111719bbeda528
SHA1

62f72ce2f5e69630c518861ccf747a3c14d6a27f
SHA256

5384e7de6b8d95a7df1d841b7a6a77e3f9418fcda9851e2b120a10019222047c
SHA512

428cc36c48b1d7a0cb8026a1c1f4540556e2d289dbbb96546ebbbe0ace53a48d9eaee929f77a78756f6e497e688da37d2798b1dd71d824ce70d04bf3694410e9
SSDEEP

24576:hS3sU7vy4scPRr8eYq5Jyb8J1uN0APDcJkdV4K:hysUe4skrYq6wJ1uiAQJIV4

Score

10^/10

pikabot botnet

Malware Config

Signatures

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1516 set thread context of 1924 1516 rundll32.exe SearchProtocolHost.exe
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exenetstat.exe

pid process

2164 ipconfig.exe
2996 netstat.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SearchProtocolHost.exe

pid process

1924 SearchProtocolHost.exe
1924 SearchProtocolHost.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

rundll32.exe

pid process

1516 rundll32.exe

description	pid	process	target process
PID 1516 set thread context of 1924	1516	rundll32.exe	SearchProtocolHost.exe

pid	process
2164	ipconfig.exe
2996	netstat.exe

pid	process
1924	SearchProtocolHost.exe
1924	SearchProtocolHost.exe

pid	process
1516	rundll32.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

Processes:

whoami.exenetstat.exe

description	pid	process
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2044	whoami.exe
Token: SeDebugPrivilege	2996	netstat.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 216 wrote to memory of 1516	216	rundll32.exe	rundll32.exe
PID 216 wrote to memory of 1516	216	rundll32.exe	rundll32.exe
PID 216 wrote to memory of 1516	216	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe
PID 1516 wrote to memory of 1924	1516	rundll32.exe	SearchProtocolHost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pikabot_unpack.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:216

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pikabot_unpack.dll,#1
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\SearchProtocolHost.exe
"C:\Windows\System32\SearchProtocolHost.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1924

C:\Windows\SysWOW64\whoami.exe
whoami.exe /all
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Windows\SysWOW64\ipconfig.exe
ipconfig.exe /all
4⤵
- Gathers network information
PID:2164

C:\Windows\SysWOW64\netstat.exe
netstat.exe -aon
4⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2996

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-0-0x0000000000290000-0x00000000002E3000-memory.dmp

Filesize
332KB

Download
memory/1924-2-0x0000000000290000-0x00000000002E3000-memory.dmp

Filesize
332KB

Download
memory/1924-3-0x0000000000290000-0x00000000002E3000-memory.dmp

Filesize
332KB

Download
memory/1924-4-0x0000000000290000-0x00000000002E3000-memory.dmp

Filesize
332KB

Download
memory/1924-5-0x0000000000290000-0x00000000002E3000-memory.dmp

Filesize
332KB

Download
memory/1924-8-0x0000000000290000-0x00000000002E3000-memory.dmp

Filesize
332KB

Download
memory/1924-9-0x0000000000290000-0x00000000002E3000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing