Resubmissions

07-05-2024 12:38

240507-pvdkrsga4z 10

16-10-2023 16:11

231016-tmwtlaab41 7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-05-2024 12:38

General

  • Target

    Birdman/Birdman.dll

  • Size

    1.8MB

  • MD5

    ec8db58467d8e2e2221635c592fcca1a

  • SHA1

    e0215d156d2dc59b6259fd5ff792dc740626c8fa

  • SHA256

    aebff5134e07a1586b911271a49702c8623b8ac8da2c135d4d3b0145a826f507

  • SHA512

    5aaf241388dbb343e059af4a0cfd4d7507189f0c94f415ba9b9d87791e5f2bf81a780f73e2bbc8bb39f90edc779987eb422192fb3facb4c0dae78c140cacb787

  • SSDEEP

    24576:FSfBk+9Zl7pC4HE+Y/lU/Z46vVJkWuQpJ53am1u46FxVDmdVxoejIF4UAVddHctD:6kFhgJ8m1u/CVxodFSfd+WC9J

Score
10/10

Malware Config

Signatures

  • Detects PikaBot botnet 8 IoCs
  • PikaBot

    PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.

  • Suspicious use of SetThreadContext 1 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Birdman\Birdman.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\Birdman\Birdman.dll,#1
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:4492
      • C:\Windows\SysWOW64\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3472
        • C:\Windows\SysWOW64\whoami.exe
          whoami.exe /all
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2744
        • C:\Windows\SysWOW64\ipconfig.exe
          ipconfig.exe /all
          4⤵
          • Gathers network information
          PID:740
        • C:\Windows\SysWOW64\netstat.exe
          netstat.exe -aon
          4⤵
          • Gathers network information
          • Suspicious use of AdjustPrivilegeToken
          PID:4956

Network

MITRE ATT&CK Matrix ATT&CK v13

Execution

Command and Scripting Interpreter

1
T1059

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3472-2-0x0000000000EA0000-0x0000000000EED000-memory.dmp
    Filesize

    308KB

  • memory/3472-4-0x0000000000EA0000-0x0000000000EED000-memory.dmp
    Filesize

    308KB

  • memory/3472-5-0x0000000000EA0000-0x0000000000EED000-memory.dmp
    Filesize

    308KB

  • memory/3472-7-0x0000000000EA0000-0x0000000000EED000-memory.dmp
    Filesize

    308KB

  • memory/3472-8-0x0000000000EA0000-0x0000000000EED000-memory.dmp
    Filesize

    308KB

  • memory/3472-9-0x0000000000EA0000-0x0000000000EED000-memory.dmp
    Filesize

    308KB

  • memory/3472-10-0x0000000000EA0000-0x0000000000EED000-memory.dmp
    Filesize

    308KB

  • memory/3472-12-0x0000000000EA0000-0x0000000000EED000-memory.dmp
    Filesize

    308KB

  • memory/4492-0-0x0000000002940000-0x00000000029FD000-memory.dmp
    Filesize

    756KB

  • memory/4492-1-0x0000000002AE0000-0x0000000002BB2000-memory.dmp
    Filesize

    840KB

  • memory/4492-6-0x0000000002AE0000-0x0000000002BB2000-memory.dmp
    Filesize

    840KB