Analysis
-
max time kernel
146s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2023 03:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128.dll
Resource
win7-20231023-en
windows7-x64
1 signatures
150 seconds
General
-
Target
fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128.dll
-
Size
795KB
-
MD5
c83fe58088ef5f05342367e71eb28873
-
SHA1
8af8c027cb0f56b6775115383f4d5bdf010a6352
-
SHA256
fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128
-
SHA512
0089a1ed148c7ea705ef9bdcaa3231ebf8d78d6e5e32a487ad4dff5aebcae33470aa1c5074d6ed55d7be37ae80526d826a1ce1c93faa6f7181848f0a0d23292d
-
SSDEEP
24576:/tR2jQOoVmT/QrwFbxE6Elpq5nOkcJofEXmi:1TMT/jb+Bl05nBcJocXmi
Malware Config
Signatures
-
Detects PikaBot botnet 6 IoCs
resource yara_rule behavioral2/memory/3728-0-0x0000000000650000-0x000000000069F000-memory.dmp family_pikabot_v2 behavioral2/memory/3728-2-0x0000000000650000-0x000000000069F000-memory.dmp family_pikabot_v2 behavioral2/memory/3728-3-0x0000000000650000-0x000000000069F000-memory.dmp family_pikabot_v2 behavioral2/memory/3728-4-0x0000000000650000-0x000000000069F000-memory.dmp family_pikabot_v2 behavioral2/memory/3728-5-0x0000000000650000-0x000000000069F000-memory.dmp family_pikabot_v2 behavioral2/memory/3728-7-0x0000000000650000-0x000000000069F000-memory.dmp family_pikabot_v2 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3456 set thread context of 3728 3456 rundll32.exe 89 -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 3144 ipconfig.exe 1640 netstat.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3728 SearchProtocolHost.exe 3728 SearchProtocolHost.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 3456 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 4696 whoami.exe Token: SeDebugPrivilege 1640 netstat.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3548 wrote to memory of 3456 3548 rundll32.exe 84 PID 3548 wrote to memory of 3456 3548 rundll32.exe 84 PID 3548 wrote to memory of 3456 3548 rundll32.exe 84 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89 PID 3456 wrote to memory of 3728 3456 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3728 -
C:\Windows\SysWOW64\whoami.exewhoami.exe /all4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4696
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig.exe /all4⤵
- Gathers network information
PID:3144
-
-
C:\Windows\SysWOW64\netstat.exenetstat.exe -aon4⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
-
Network
-
Remote address:8.8.8.8:53Request39.142.81.104.in-addr.arpaIN PTRResponse39.142.81.104.in-addr.arpaIN PTRa104-81-142-39deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.a-0001.a-msedge.netg-bing-com.a-0001.a-msedge.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=bcbb8f4ef115421f80ba1d9d12532185&localId=w:5DA71B07-9A86-3028-7BAC-0A2B03A6FF03&deviceId=6896189400010801&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=bcbb8f4ef115421f80ba1d9d12532185&localId=w:5DA71B07-9A86-3028-7BAC-0A2B03A6FF03&deviceId=6896189400010801&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=310042BA617B6DB215FB516D60966C92; domain=.bing.com; expires=Sun, 22-Dec-2024 03:12:51 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 93FAB55CBCD04AC1B3EBA9584CADA0E6 Ref B: AMS04EDGE3309 Ref C: 2023-11-28T03:12:51Z
date: Tue, 28 Nov 2023 03:12:50 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=bcbb8f4ef115421f80ba1d9d12532185&localId=w:5DA71B07-9A86-3028-7BAC-0A2B03A6FF03&deviceId=6896189400010801&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=bcbb8f4ef115421f80ba1d9d12532185&localId=w:5DA71B07-9A86-3028-7BAC-0A2B03A6FF03&deviceId=6896189400010801&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=310042BA617B6DB215FB516D60966C92
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 371F12EABC80450EBF7E00B9B1BCB983 Ref B: AMS04EDGE3309 Ref C: 2023-11-28T03:12:51Z
date: Tue, 28 Nov 2023 03:12:50 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=bcbb8f4ef115421f80ba1d9d12532185&localId=w:5DA71B07-9A86-3028-7BAC-0A2B03A6FF03&deviceId=6896189400010801&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=bcbb8f4ef115421f80ba1d9d12532185&localId=w:5DA71B07-9A86-3028-7BAC-0A2B03A6FF03&deviceId=6896189400010801&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=310042BA617B6DB215FB516D60966C92
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7CC6EF0F62754841897990D304BAABC0 Ref B: AMS04EDGE3309 Ref C: 2023-11-28T03:12:51Z
date: Tue, 28 Nov 2023 03:12:50 GMT
-
Remote address:8.8.8.8:53Request88.156.103.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request200.197.79.204.in-addr.arpaIN PTRResponse200.197.79.204.in-addr.arpaIN PTRa-0001a-msedgenet
-
Remote address:8.8.8.8:53Request107.175.53.84.in-addr.arpaIN PTRResponse107.175.53.84.in-addr.arpaIN PTRa84-53-175-107deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request13.173.189.20.in-addr.arpaIN PTRResponse
-
204.79.197.200:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=bcbb8f4ef115421f80ba1d9d12532185&localId=w:5DA71B07-9A86-3028-7BAC-0A2B03A6FF03&deviceId=6896189400010801&anid=tls, http21.9kB 9.3kB 22 20
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=bcbb8f4ef115421f80ba1d9d12532185&localId=w:5DA71B07-9A86-3028-7BAC-0A2B03A6FF03&deviceId=6896189400010801&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=bcbb8f4ef115421f80ba1d9d12532185&localId=w:5DA71B07-9A86-3028-7BAC-0A2B03A6FF03&deviceId=6896189400010801&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=bcbb8f4ef115421f80ba1d9d12532185&localId=w:5DA71B07-9A86-3028-7BAC-0A2B03A6FF03&deviceId=6896189400010801&anid=HTTP Response
204 -
260 B 5
-
72 B 137 B 1 1
DNS Request
39.142.81.104.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
56 B 158 B 1 1
DNS Request
g.bing.com
DNS Response
204.79.197.20013.107.21.200
-
72 B 158 B 1 1
DNS Request
88.156.103.20.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
9.228.82.20.in-addr.arpa
-
73 B 106 B 1 1
DNS Request
200.197.79.204.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
107.175.53.84.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.227.111.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
13.173.189.20.in-addr.arpa