Analysis
-
max time kernel
168s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2023 17:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128.dll
Resource
win7-20231023-en
windows7-x64
1 signatures
150 seconds
General
-
Target
fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128.dll
-
Size
795KB
-
MD5
c83fe58088ef5f05342367e71eb28873
-
SHA1
8af8c027cb0f56b6775115383f4d5bdf010a6352
-
SHA256
fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128
-
SHA512
0089a1ed148c7ea705ef9bdcaa3231ebf8d78d6e5e32a487ad4dff5aebcae33470aa1c5074d6ed55d7be37ae80526d826a1ce1c93faa6f7181848f0a0d23292d
-
SSDEEP
24576:/tR2jQOoVmT/QrwFbxE6Elpq5nOkcJofEXmi:1TMT/jb+Bl05nBcJocXmi
Malware Config
Signatures
-
Detects PikaBot botnet 9 IoCs
resource yara_rule behavioral2/memory/4296-0-0x0000000000980000-0x00000000009CF000-memory.dmp family_pikabot_v2 behavioral2/memory/4296-2-0x0000000000980000-0x00000000009CF000-memory.dmp family_pikabot_v2 behavioral2/memory/4296-3-0x0000000000980000-0x00000000009CF000-memory.dmp family_pikabot_v2 behavioral2/memory/4296-4-0x0000000000980000-0x00000000009CF000-memory.dmp family_pikabot_v2 behavioral2/memory/4296-5-0x0000000000980000-0x00000000009CF000-memory.dmp family_pikabot_v2 behavioral2/memory/4296-6-0x0000000000980000-0x00000000009CF000-memory.dmp family_pikabot_v2 behavioral2/memory/4296-7-0x0000000000980000-0x00000000009CF000-memory.dmp family_pikabot_v2 behavioral2/memory/4296-8-0x0000000000980000-0x00000000009CF000-memory.dmp family_pikabot_v2 behavioral2/memory/4296-11-0x0000000000980000-0x00000000009CF000-memory.dmp family_pikabot_v2 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 984 set thread context of 4296 984 rundll32.exe 89 -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4972 ipconfig.exe 2272 netstat.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4296 SearchProtocolHost.exe 4296 SearchProtocolHost.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 984 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2252 whoami.exe Token: SeDebugPrivilege 2272 netstat.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3120 wrote to memory of 984 3120 rundll32.exe 84 PID 3120 wrote to memory of 984 3120 rundll32.exe 84 PID 3120 wrote to memory of 984 3120 rundll32.exe 84 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89 PID 984 wrote to memory of 4296 984 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4296 -
C:\Windows\SysWOW64\whoami.exewhoami.exe /all4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2252
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig.exe /all4⤵
- Gathers network information
PID:4972
-
-
C:\Windows\SysWOW64\netstat.exenetstat.exe -aon4⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2272
-
-
-