Analysis
-
max time kernel
146s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2023 03:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128.dll
Resource
win7-20231023-en
windows7-x64
1 signatures
150 seconds
General
-
Target
fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128.dll
-
Size
795KB
-
MD5
c83fe58088ef5f05342367e71eb28873
-
SHA1
8af8c027cb0f56b6775115383f4d5bdf010a6352
-
SHA256
fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128
-
SHA512
0089a1ed148c7ea705ef9bdcaa3231ebf8d78d6e5e32a487ad4dff5aebcae33470aa1c5074d6ed55d7be37ae80526d826a1ce1c93faa6f7181848f0a0d23292d
-
SSDEEP
24576:/tR2jQOoVmT/QrwFbxE6Elpq5nOkcJofEXmi:1TMT/jb+Bl05nBcJocXmi
Malware Config
Signatures
-
Detects PikaBot botnet 6 IoCs
resource yara_rule behavioral2/memory/3728-0-0x0000000000650000-0x000000000069F000-memory.dmp family_pikabot_v2 behavioral2/memory/3728-2-0x0000000000650000-0x000000000069F000-memory.dmp family_pikabot_v2 behavioral2/memory/3728-3-0x0000000000650000-0x000000000069F000-memory.dmp family_pikabot_v2 behavioral2/memory/3728-4-0x0000000000650000-0x000000000069F000-memory.dmp family_pikabot_v2 behavioral2/memory/3728-5-0x0000000000650000-0x000000000069F000-memory.dmp family_pikabot_v2 behavioral2/memory/3728-7-0x0000000000650000-0x000000000069F000-memory.dmp family_pikabot_v2 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3456 set thread context of 3728 3456 rundll32.exe 89 -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 3144 ipconfig.exe 1640 netstat.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3728 SearchProtocolHost.exe 3728 SearchProtocolHost.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 3456 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 1640 netstat.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3548 wrote to memory of 3456 3548 rundll32.exe 84 PID 3548 wrote to memory of 3456 3548 rundll32.exe 84 PID 3548 wrote to memory of 3456 3548 rundll32.exe 84 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3728 -
C:\Windows\SysWOW64\whoami.exewhoami.exe /all4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4696
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig.exe /all4⤵
- Gathers network information
PID:3144
-
-
C:\Windows\SysWOW64\netstat.exenetstat.exe -aon4⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
-