Analysis
- max time kernel
168s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20231023-en - resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system - submitted
27/11/2023, 17:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128.dll
Resource
win7-20231023-en
windows7-x64
1 signatures
150 seconds
General
- Target fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128.dll
- Size 795KB
- Sample231127-vvj1faag5v
- SHA256 fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128
- MD5 c83fe58088ef5f05342367e71eb28873
- SHA1 8af8c027cb0f56b6775115383f4d5bdf010a6352
- SHA512 0089a1ed148c7ea705ef9bdcaa3231ebf8d78d6e5e32a487ad4dff5aebcae33470aa1c5074d6ed55d7be37ae80526d826a1ce1c93faa6f7181848f0a0d23292d
- SSDEEP 24576:/tR2jQOoVmT/QrwFbxE6Elpq5nOkcJofEXmi:1TMT/jb+Bl05nBcJocXmi
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects PikaBot botnet 9 IoCs
resource yara_rule behavioral2/memory/4296-0-0x0000000000980000-0x00000000009CF000-memory.dmp family_pikabot_v2 behavioral2/memory/4296-2-0x0000000000980000-0x00000000009CF000-memory.dmp family_pikabot_v2 behavioral2/memory/4296-3-0x0000000000980000-0x00000000009CF000-memory.dmp family_pikabot_v2 behavioral2/memory/4296-4-0x0000000000980000-0x00000000009CF000-memory.dmp family_pikabot_v2 behavioral2/memory/4296-5-0x0000000000980000-0x00000000009CF000-memory.dmp family_pikabot_v2 behavioral2/memory/4296-6-0x0000000000980000-0x00000000009CF000-memory.dmp family_pikabot_v2 behavioral2/memory/4296-7-0x0000000000980000-0x00000000009CF000-memory.dmp family_pikabot_v2 behavioral2/memory/4296-8-0x0000000000980000-0x00000000009CF000-memory.dmp family_pikabot_v2 behavioral2/memory/4296-11-0x0000000000980000-0x00000000009CF000-memory.dmp family_pikabot_v2 - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 984 set thread context of 4296 984 rundll32.exe 89 - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4972 ipconfig.exe 2272 netstat.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4296 SearchProtocolHost.exe 4296 SearchProtocolHost.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 984 rundll32.exe - Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2272 netstat.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3120 wrote to memory of 984 3120 rundll32.exe 84 PID 3120 wrote to memory of 984 3120 rundll32.exe 84 PID 3120 wrote to memory of 984 3120 rundll32.exe 84 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4296 -
C:\Windows\SysWOW64\whoami.exewhoami.exe /all4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2252
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig.exe /all4⤵
- Gathers network information
PID:4972
-
-
C:\Windows\SysWOW64\netstat.exenetstat.exe -aon4⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2272
-
-
-