Analysis
-
max time kernel
147s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22-01-2024 19:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81.dll
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
General
-
Target
e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81.dll
-
Size
507KB
-
MD5
a0b9376d1a46e876fe056dd89b79dfca
-
SHA1
1b363e22c6a51341e16ef4a1177596504974e066
-
SHA256
e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81
-
SHA512
08a9b9de4b8ff6aebe1f9846e5e1994370796b4aa19613178dc320482cf68bf2ee1fb66e7925e1e4887febf398457f04e2193d48b7198d050e6666125802b946
-
SSDEEP
12288:nljxPw/KI5MGpBRTf4LvGCAotHnG4CEu+AvHuzfsdzjbHgRV:zPkKIGsBRTydjG4GxbHU
Malware Config
Extracted
Family
pikabot
C2
192.248.174.52:5631
109.123.227.104:2221
65.20.98.24:13783
154.38.184.3:2223
155.138.203.158:1194
210.243.8.247:23399
139.180.185.171:2222
154.221.30.136:13724
65.20.82.254:5243
Signatures
-
Detects PikaBot botnet 4 IoCs
resource yara_rule behavioral2/memory/2000-0-0x0000000000FB0000-0x0000000000FFF000-memory.dmp family_pikabot_v2 behavioral2/memory/2000-1-0x0000000000FB0000-0x0000000000FFF000-memory.dmp family_pikabot_v2 behavioral2/memory/2000-2-0x0000000000FB0000-0x0000000000FFF000-memory.dmp family_pikabot_v2 behavioral2/memory/2000-5-0x0000000000FB0000-0x0000000000FFF000-memory.dmp family_pikabot_v2 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2348 set thread context of 2000 2348 rundll32.exe 88 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2000 SearchProtocolHost.exe 2000 SearchProtocolHost.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 2348 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 324 wrote to memory of 2348 324 rundll32.exe 86 PID 324 wrote to memory of 2348 324 rundll32.exe 86 PID 324 wrote to memory of 2348 324 rundll32.exe 86 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88 PID 2348 wrote to memory of 2000 2348 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e1179516c0fe8cbf69566d5db63c6d1d7d02d67b04eae5800f9a950fb07fee81.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2000
-
-