Analysis
-
max time kernel
261s -
max time network
224s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
11-01-2024 00:05
Static task
static1
General
-
Target
e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81.dll
-
Size
507KB
-
MD5
a0b9376d1a46e876fe056dd89b79dfca
-
SHA1
1b363e22c6a51341e16ef4a1177596504974e066
-
SHA256
e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81
-
SHA512
08a9b9de4b8ff6aebe1f9846e5e1994370796b4aa19613178dc320482cf68bf2ee1fb66e7925e1e4887febf398457f04e2193d48b7198d050e6666125802b946
-
SSDEEP
12288:nljxPw/KI5MGpBRTf4LvGCAotHnG4CEu+AvHuzfsdzjbHgRV:zPkKIGsBRTydjG4GxbHU
Malware Config
Signatures
-
Detects PikaBot botnet 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1896-0-0x00000000001B0000-0x00000000001FF000-memory.dmp family_pikabot_v2 behavioral1/memory/1896-1-0x00000000001B0000-0x00000000001FF000-memory.dmp family_pikabot_v2 behavioral1/memory/1896-2-0x00000000001B0000-0x00000000001FF000-memory.dmp family_pikabot_v2 behavioral1/memory/1896-5-0x00000000001B0000-0x00000000001FF000-memory.dmp family_pikabot_v2 behavioral1/memory/1896-16-0x00000000001B0000-0x00000000001FF000-memory.dmp family_pikabot_v2 behavioral1/memory/1896-18-0x00000000001B0000-0x00000000001FF000-memory.dmp family_pikabot_v2 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 2788 set thread context of 1896 2788 rundll32.exe SearchProtocolHost.exe -
Modifies registry class 1 IoCs
Processes:
MiniSearchHost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1199853020-417986905-91977573-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 244 vlc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SearchProtocolHost.exepid process 1896 SearchProtocolHost.exe 1896 SearchProtocolHost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 244 vlc.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
Processes:
rundll32.exepid process 2788 rundll32.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
vlc.exepid process 244 vlc.exe 244 vlc.exe 244 vlc.exe 244 vlc.exe 244 vlc.exe 244 vlc.exe 244 vlc.exe 244 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
Processes:
vlc.exepid process 244 vlc.exe 244 vlc.exe 244 vlc.exe 244 vlc.exe 244 vlc.exe 244 vlc.exe 244 vlc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
MiniSearchHost.exevlc.exepid process 1056 MiniSearchHost.exe 244 vlc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1360 wrote to memory of 2788 1360 rundll32.exe rundll32.exe PID 1360 wrote to memory of 2788 1360 rundll32.exe rundll32.exe PID 1360 wrote to memory of 2788 1360 rundll32.exe rundll32.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe PID 2788 wrote to memory of 1896 2788 rundll32.exe SearchProtocolHost.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\GrantSave.asx"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\GrantSave.asx"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/244-40-0x00007FFCECDE0000-0x00007FFCEDE8B000-memory.dmpFilesize
16.7MB
-
memory/244-53-0x00007FFCEEEA0000-0x00007FFCEEEF6000-memory.dmpFilesize
344KB
-
memory/244-54-0x00007FFD00070000-0x00007FFD00098000-memory.dmpFilesize
160KB
-
memory/244-55-0x00007FFCFFF60000-0x00007FFCFFF84000-memory.dmpFilesize
144KB
-
memory/244-56-0x00007FFCFFF40000-0x00007FFCFFF57000-memory.dmpFilesize
92KB
-
memory/244-57-0x00007FFCFFDC0000-0x00007FFCFFDE3000-memory.dmpFilesize
140KB
-
memory/244-41-0x00007FFD00970000-0x00007FFD00991000-memory.dmpFilesize
132KB
-
memory/244-59-0x00007FFCFFC90000-0x00007FFCFFCA2000-memory.dmpFilesize
72KB
-
memory/244-60-0x00007FFCF5350000-0x00007FFCF5371000-memory.dmpFilesize
132KB
-
memory/244-64-0x00007FFCF4FD0000-0x00007FFCF4FFC000-memory.dmpFilesize
176KB
-
memory/244-61-0x00007FFCF5170000-0x00007FFCF5183000-memory.dmpFilesize
76KB
-
memory/244-42-0x00007FFD008B0000-0x00007FFD008C8000-memory.dmpFilesize
96KB
-
memory/244-28-0x00007FF692020000-0x00007FF692118000-memory.dmpFilesize
992KB
-
memory/244-29-0x00007FFD08A00000-0x00007FFD08A34000-memory.dmpFilesize
208KB
-
memory/244-30-0x00007FFCEEA80000-0x00007FFCEED34000-memory.dmpFilesize
2.7MB
-
memory/244-33-0x00007FFD05E60000-0x00007FFD05E71000-memory.dmpFilesize
68KB
-
memory/244-31-0x00007FFD08A40000-0x00007FFD08A58000-memory.dmpFilesize
96KB
-
memory/244-32-0x00007FFD06C60000-0x00007FFD06C77000-memory.dmpFilesize
92KB
-
memory/244-34-0x00007FFD00E40000-0x00007FFD00E57000-memory.dmpFilesize
92KB
-
memory/244-35-0x00007FFD00B80000-0x00007FFD00B91000-memory.dmpFilesize
68KB
-
memory/244-62-0x00007FFCF5150000-0x00007FFCF5162000-memory.dmpFilesize
72KB
-
memory/244-36-0x00007FFD00A00000-0x00007FFD00A1D000-memory.dmpFilesize
116KB
-
memory/244-38-0x00007FFCEDE90000-0x00007FFCEE090000-memory.dmpFilesize
2.0MB
-
memory/244-39-0x00007FFD009A0000-0x00007FFD009DF000-memory.dmpFilesize
252KB
-
memory/244-37-0x00007FFD009E0000-0x00007FFD009F1000-memory.dmpFilesize
68KB
-
memory/244-63-0x00007FFCEED60000-0x00007FFCEEE9B000-memory.dmpFilesize
1.2MB
-
memory/244-58-0x00007FFCFFD80000-0x00007FFCFFD91000-memory.dmpFilesize
68KB
-
memory/244-43-0x00007FFD00890000-0x00007FFD008A1000-memory.dmpFilesize
68KB
-
memory/244-44-0x00007FFD00870000-0x00007FFD00881000-memory.dmpFilesize
68KB
-
memory/244-45-0x00007FFD00850000-0x00007FFD00861000-memory.dmpFilesize
68KB
-
memory/244-46-0x00007FFD00830000-0x00007FFD0084B000-memory.dmpFilesize
108KB
-
memory/244-47-0x00007FFD00230000-0x00007FFD00241000-memory.dmpFilesize
68KB
-
memory/244-48-0x00007FFD00210000-0x00007FFD00228000-memory.dmpFilesize
96KB
-
memory/244-49-0x00007FFD001E0000-0x00007FFD00210000-memory.dmpFilesize
192KB
-
memory/244-50-0x00007FFCFFF90000-0x00007FFCFFFF7000-memory.dmpFilesize
412KB
-
memory/244-51-0x00007FFCF6300000-0x00007FFCF636F000-memory.dmpFilesize
444KB
-
memory/244-52-0x00007FFD001C0000-0x00007FFD001D1000-memory.dmpFilesize
68KB
-
memory/1896-1-0x00000000001B0000-0x00000000001FF000-memory.dmpFilesize
316KB
-
memory/1896-0-0x00000000001B0000-0x00000000001FF000-memory.dmpFilesize
316KB
-
memory/1896-18-0x00000000001B0000-0x00000000001FF000-memory.dmpFilesize
316KB
-
memory/1896-16-0x00000000001B0000-0x00000000001FF000-memory.dmpFilesize
316KB
-
memory/1896-5-0x00000000001B0000-0x00000000001FF000-memory.dmpFilesize
316KB
-
memory/1896-2-0x00000000001B0000-0x00000000001FF000-memory.dmpFilesize
316KB
-
memory/3172-27-0x00007FFD05E60000-0x00007FFD05E71000-memory.dmpFilesize
68KB
-
memory/3172-21-0x00007FF692020000-0x00007FF692118000-memory.dmpFilesize
992KB
-
memory/3172-26-0x00007FFD06C60000-0x00007FFD06C77000-memory.dmpFilesize
92KB
-
memory/3172-25-0x00007FFD08A40000-0x00007FFD08A58000-memory.dmpFilesize
96KB
-
memory/3172-23-0x00007FFCEEA80000-0x00007FFCEED34000-memory.dmpFilesize
2.7MB
-
memory/3172-22-0x00007FFD08A00000-0x00007FFD08A34000-memory.dmpFilesize
208KB