Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04-01-2024 20:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81.dll
Resource
win7-20231215-en
1 signatures
150 seconds
General
-
Target
e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81.dll
-
Size
507KB
-
MD5
a0b9376d1a46e876fe056dd89b79dfca
-
SHA1
1b363e22c6a51341e16ef4a1177596504974e066
-
SHA256
e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81
-
SHA512
08a9b9de4b8ff6aebe1f9846e5e1994370796b4aa19613178dc320482cf68bf2ee1fb66e7925e1e4887febf398457f04e2193d48b7198d050e6666125802b946
-
SSDEEP
12288:nljxPw/KI5MGpBRTf4LvGCAotHnG4CEu+AvHuzfsdzjbHgRV:zPkKIGsBRTydjG4GxbHU
Malware Config
Signatures
-
Detects PikaBot botnet 5 IoCs
Processes:
resource yara_rule behavioral2/memory/2348-0-0x00000000009C0000-0x0000000000A0F000-memory.dmp family_pikabot_v2 behavioral2/memory/2348-1-0x00000000009C0000-0x0000000000A0F000-memory.dmp family_pikabot_v2 behavioral2/memory/2348-2-0x00000000009C0000-0x0000000000A0F000-memory.dmp family_pikabot_v2 behavioral2/memory/2348-3-0x00000000009C0000-0x0000000000A0F000-memory.dmp family_pikabot_v2 behavioral2/memory/2348-5-0x00000000009C0000-0x0000000000A0F000-memory.dmp family_pikabot_v2 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 2064 set thread context of 2348 2064 rundll32.exe SearchProtocolHost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SearchProtocolHost.exepid process 2348 SearchProtocolHost.exe 2348 SearchProtocolHost.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
Processes:
rundll32.exepid process 2064 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3192 wrote to memory of 2064 3192 rundll32.exe rundll32.exe PID 3192 wrote to memory of 2064 3192 rundll32.exe rundll32.exe PID 3192 wrote to memory of 2064 3192 rundll32.exe rundll32.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe PID 2064 wrote to memory of 2348 2064 rundll32.exe SearchProtocolHost.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2348-0-0x00000000009C0000-0x0000000000A0F000-memory.dmpFilesize
316KB
-
memory/2348-1-0x00000000009C0000-0x0000000000A0F000-memory.dmpFilesize
316KB
-
memory/2348-2-0x00000000009C0000-0x0000000000A0F000-memory.dmpFilesize
316KB
-
memory/2348-3-0x00000000009C0000-0x0000000000A0F000-memory.dmpFilesize
316KB
-
memory/2348-5-0x00000000009C0000-0x0000000000A0F000-memory.dmpFilesize
316KB