Resubmissions
22-01-2024 19:16
240122-xy3cascdgm 1015-11-2023 07:49
231115-jn5ssaed96 1013-11-2023 17:10
231113-vppczaef64 5Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22-01-2024 19:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Punta.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
General
-
Target
Punta.exe
-
Size
1.0MB
-
MD5
f61d5fb45db0f9b6073f9e77d172bba3
-
SHA1
74d9aa7d3a56fc20145e83d33d8ed92a127fe382
-
SHA256
0cd962aba91336f6b82e54c35a7afa922981cfe776607cb2a2e1b072871fe2d1
-
SHA512
a0f7183cdbca71ec035e85626a9f9d0cd278597fd6a3c7262e30eb5cf77a8a2a14ea7d105ee5f51de9aa884575d67e52ca777fe80418cf1bfba4ee2030f3b46b
-
SSDEEP
24576:UkdMJtCwN/TZyUsxmFQHIxkxa4U6TrZV:UkkvR84FQHUEUEH
Malware Config
Signatures
-
Detects PikaBot botnet 6 IoCs
resource yara_rule behavioral2/memory/1152-2-0x0000000000970000-0x00000000009BF000-memory.dmp family_pikabot_v2 behavioral2/memory/1152-4-0x0000000000970000-0x00000000009BF000-memory.dmp family_pikabot_v2 behavioral2/memory/1152-5-0x0000000000970000-0x00000000009BF000-memory.dmp family_pikabot_v2 behavioral2/memory/1152-7-0x0000000000970000-0x00000000009BF000-memory.dmp family_pikabot_v2 behavioral2/memory/1152-8-0x0000000000970000-0x00000000009BF000-memory.dmp family_pikabot_v2 behavioral2/memory/1152-10-0x0000000000970000-0x00000000009BF000-memory.dmp family_pikabot_v2 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1980 set thread context of 1152 1980 Punta.exe 88 -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1456 ipconfig.exe 3104 netstat.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1152 SearchProtocolHost.exe 1152 SearchProtocolHost.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 1980 Punta.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 5088 whoami.exe Token: SeDebugPrivilege 3104 netstat.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88 PID 1980 wrote to memory of 1152 1980 Punta.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\Punta.exe"C:\Users\Admin\AppData\Local\Temp\Punta.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1152 -
C:\Windows\SysWOW64\whoami.exewhoami.exe /all3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5088
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig.exe /all3⤵
- Gathers network information
PID:1456
-
-
C:\Windows\SysWOW64\netstat.exenetstat.exe -aon3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:3104
-
-