Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
10-01-2024 23:56
Static task
static1
1 signatures
General
-
Target
e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81.dll
-
Size
507KB
-
MD5
a0b9376d1a46e876fe056dd89b79dfca
-
SHA1
1b363e22c6a51341e16ef4a1177596504974e066
-
SHA256
e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81
-
SHA512
08a9b9de4b8ff6aebe1f9846e5e1994370796b4aa19613178dc320482cf68bf2ee1fb66e7925e1e4887febf398457f04e2193d48b7198d050e6666125802b946
-
SSDEEP
12288:nljxPw/KI5MGpBRTf4LvGCAotHnG4CEu+AvHuzfsdzjbHgRV:zPkKIGsBRTydjG4GxbHU
Malware Config
Signatures
-
Detects PikaBot botnet 4 IoCs
Processes:
resource yara_rule behavioral1/memory/4824-1-0x0000000000400000-0x000000000044F000-memory.dmp family_pikabot_v2 behavioral1/memory/4824-0-0x0000000000400000-0x000000000044F000-memory.dmp family_pikabot_v2 behavioral1/memory/4824-2-0x0000000000400000-0x000000000044F000-memory.dmp family_pikabot_v2 behavioral1/memory/4824-5-0x0000000000400000-0x000000000044F000-memory.dmp family_pikabot_v2 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 3648 set thread context of 4824 3648 rundll32.exe SearchProtocolHost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SearchProtocolHost.exepid process 4824 SearchProtocolHost.exe 4824 SearchProtocolHost.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
Processes:
rundll32.exepid process 3648 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 4272 wrote to memory of 3648 4272 rundll32.exe rundll32.exe PID 4272 wrote to memory of 3648 4272 rundll32.exe rundll32.exe PID 4272 wrote to memory of 3648 4272 rundll32.exe rundll32.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe PID 3648 wrote to memory of 4824 3648 rundll32.exe SearchProtocolHost.exe
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81.dll,#11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81.dll,#11⤵
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4824-1-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4824-0-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4824-2-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4824-5-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB