pikabot | 2be644cec6f2caf1ddf4e404d2b381c933b926b4d90337230f42013c0b9c7ffa

General

Target

run.bat
Size

51B
MD5

3044c13a564ee6bd79c39265b2fde131
SHA1

cff15aa8a701795e9f33b74862a6543c66fd5907
SHA256

4a5ba34c467a320db4a3da2512cf455f9dabf573fd41f5c1ba13becd70cc31aa
SHA512

732677b92c94638f477d4b22e94485a8b59fc0bd90bd35ba9fc2497f2fbdca197acd89b432a7ad6f4bc375c28a02aa49248efebfb68a285f94d74adad7d56956

Score

10^/10

pikabot botnet dave

Malware Config

Signatures

Detects PikaBot botnet 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4960-9-0x00000000005F0000-0x0000000000630000-memory.dmp	family_pikabot_v2
behavioral2/memory/4960-10-0x00000000005F0000-0x0000000000630000-memory.dmp	family_pikabot_v2
behavioral2/memory/4960-11-0x00000000005F0000-0x0000000000630000-memory.dmp	family_pikabot_v2

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot

Dave packer 1 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

dave

Processes:

resource	yara_rule
behavioral2/memory/4076-3-0x0000000002740000-0x00000000027B3000-memory.dmp	dave

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 4076 set thread context of 4960 4076 rundll32.exe SearchFilterHost.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SearchFilterHost.exe

pid process

4960 SearchFilterHost.exe
4960 SearchFilterHost.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

rundll32.exe

pid process

4076 rundll32.exe

description	pid	process	target process
PID 4076 set thread context of 4960	4076	rundll32.exe	SearchFilterHost.exe

pid	process
4960	SearchFilterHost.exe
4960	SearchFilterHost.exe

pid	process
4076	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exerundll32.exerundll32.exe

description	pid	process	target process
PID 1184 wrote to memory of 2940	1184	cmd.exe	rundll32.exe
PID 1184 wrote to memory of 2940	1184	cmd.exe	rundll32.exe
PID 2940 wrote to memory of 4076	2940	rundll32.exe	rundll32.exe
PID 2940 wrote to memory of 4076	2940	rundll32.exe	rundll32.exe
PID 2940 wrote to memory of 4076	2940	rundll32.exe	rundll32.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe
PID 4076 wrote to memory of 4960	4076	rundll32.exe	SearchFilterHost.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pikabot.dll,Enter
2⤵
- Suspicious use of WriteProcessMemory
PID:2940

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pikabot.dll,Enter
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4076

C:\Windows\SysWOW64\SearchFilterHost.exe
"C:\Windows\System32\SearchFilterHost.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4076-0-0x00000000027C0000-0x0000000002836000-memory.dmp

Filesize
472KB

Download
memory/4076-3-0x0000000002740000-0x00000000027B3000-memory.dmp

Filesize
460KB

Download
memory/4076-5-0x0000000002840000-0x00000000028B4000-memory.dmp

Filesize
464KB

Download
memory/4960-9-0x00000000005F0000-0x0000000000630000-memory.dmp

Filesize
256KB

Download
memory/4960-10-0x00000000005F0000-0x0000000000630000-memory.dmp

Filesize
256KB

Download
memory/4960-11-0x00000000005F0000-0x0000000000630000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads