Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04-01-2024 20:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
General
-
Target
e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81.dll
-
Size
507KB
-
MD5
a0b9376d1a46e876fe056dd89b79dfca
-
SHA1
1b363e22c6a51341e16ef4a1177596504974e066
-
SHA256
e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81
-
SHA512
08a9b9de4b8ff6aebe1f9846e5e1994370796b4aa19613178dc320482cf68bf2ee1fb66e7925e1e4887febf398457f04e2193d48b7198d050e6666125802b946
-
SSDEEP
12288:nljxPw/KI5MGpBRTf4LvGCAotHnG4CEu+AvHuzfsdzjbHgRV:zPkKIGsBRTydjG4GxbHU
Malware Config
Signatures
-
Detects PikaBot botnet 5 IoCs
resource yara_rule behavioral2/memory/2348-0-0x00000000009C0000-0x0000000000A0F000-memory.dmp family_pikabot_v2 behavioral2/memory/2348-1-0x00000000009C0000-0x0000000000A0F000-memory.dmp family_pikabot_v2 behavioral2/memory/2348-2-0x00000000009C0000-0x0000000000A0F000-memory.dmp family_pikabot_v2 behavioral2/memory/2348-3-0x00000000009C0000-0x0000000000A0F000-memory.dmp family_pikabot_v2 behavioral2/memory/2348-5-0x00000000009C0000-0x0000000000A0F000-memory.dmp family_pikabot_v2 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2064 set thread context of 2348 2064 rundll32.exe 90 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2348 SearchProtocolHost.exe 2348 SearchProtocolHost.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 2064 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3192 wrote to memory of 2064 3192 rundll32.exe 88 PID 3192 wrote to memory of 2064 3192 rundll32.exe 88 PID 3192 wrote to memory of 2064 3192 rundll32.exe 88 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90 PID 2064 wrote to memory of 2348 2064 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2348
-
-