Analysis
-
max time kernel
0s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
submitted
05-01-2024 03:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
General
Malware Config
Extracted
Family
pikabot
C2
192.248.174.52:5631
109.123.227.104:2221
65.20.98.24:13783
154.38.184.3:2223
155.138.203.158:1194
210.243.8.247:23399
139.180.185.171:2222
154.221.30.136:13724
65.20.82.254:5243
Signatures
-
Detects PikaBot botnet 4 IoCs
resource yara_rule behavioral2/memory/2708-1-0x0000000000DD0000-0x0000000000E1F000-memory.dmp family_pikabot_v2 behavioral2/memory/2708-0-0x0000000000DD0000-0x0000000000E1F000-memory.dmp family_pikabot_v2 behavioral2/memory/2708-2-0x0000000000DD0000-0x0000000000E1F000-memory.dmp family_pikabot_v2 behavioral2/memory/2708-5-0x0000000000DD0000-0x0000000000E1F000-memory.dmp family_pikabot_v2 -
Pikabot family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 3868 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4004 wrote to memory of 3868 4004 rundll32.exe 16 PID 4004 wrote to memory of 3868 4004 rundll32.exe 16 PID 4004 wrote to memory of 3868 4004 rundll32.exe 16 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20 PID 3868 wrote to memory of 2708 3868 rundll32.exe 20
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81.dll,#11⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"2⤵PID:2708
-
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4004