Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
29/02/2024, 13:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9e41ab878ad1924c3f9f3cfef1c550cd.dll
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
General
- Target 9e41ab878ad1924c3f9f3cfef1c550cd.dll
- Size 935KB
- Sample240229-rakvfsbf75
- SHA256 f937fef301af0179181c939e67d2e9f7e5d9eb61228ddd5f13d3bf58d9b500c4
- MD5 9e41ab878ad1924c3f9f3cfef1c550cd
- SHA1 a46b433e5b93c86f711e60ce4e08a8da41ffa9a1
- SHA512 d2822f5c8c1e9300079544d3df58a3982533b7a73bb84b995305897a71ee4d06934c419e60aca8b4021cfcd9c338d4dd6dd38276e0d5761af54993542f33b430
- SSDEEP 12288:2qOfdYcwbu2jfQXSw7iDDVScHBsgVitfm5tltS2cevzXi1I09sjjGEzU3A:Vs/ONf1w7sw8s9whtSVCDWs/GEgA
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
pikabot
C2
-
141.95.106.106
-
104.129.55.106
-
104.129.55.105
-
23.226.138.161
-
145.239.135.24
-
85.239.243.155
-
23.226.138.143
-
57.128.165.176
-
178.18.246.136
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4548 set thread context of 1848 4548 rundll32.exe 99 - Program crash 1 IoCs
pid pid_target Process procid_target 3484 4548 WerFault.exe 95 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4548 rundll32.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 4548 rundll32.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 220 wrote to memory of 4548 220 rundll32.exe 95 PID 220 wrote to memory of 4548 220 rundll32.exe 95 PID 220 wrote to memory of 4548 220 rundll32.exe 95 PID 4548 wrote to memory of 1848 4548 rundll32.exe 99 PID 4548 wrote to memory of 1848 4548 rundll32.exe 99 PID 4548 wrote to memory of 1848 4548 rundll32.exe 99 PID 4548 wrote to memory of 1848 4548 rundll32.exe 99 PID 4548 wrote to memory of 1848 4548 rundll32.exe 99 PID 4548 wrote to memory of 1848 4548 rundll32.exe 99 PID 4548 wrote to memory of 1848 4548 rundll32.exe 99 PID 4548 wrote to memory of 1848 4548 rundll32.exe 99
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9e41ab878ad1924c3f9f3cfef1c550cd.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9e41ab878ad1924c3f9f3cfef1c550cd.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\ctfmon.exe"C:\Windows\SysWOW64\ctfmon.exe -p 1234"3⤵PID:1848
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 6203⤵
- Program crash
PID:3484
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4548 -ip 45481⤵PID:8
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3844 --field-trial-handle=2256,i,6057863739127169200,6895476048812676039,262144 --variations-seed-version /prefetch:81⤵PID:2392