Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 12:38
Static task
static1
Behavioral task
behavioral1
Sample
Birdman/Birdman.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Birdman/Birdman.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
Birdman/TZZ.pdf.lnk
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
Birdman/TZZ.pdf.lnk
Resource
win10v2004-20240419-en
General
-
Target
Birdman/Birdman.dll
-
Size
1.8MB
-
MD5
ec8db58467d8e2e2221635c592fcca1a
-
SHA1
e0215d156d2dc59b6259fd5ff792dc740626c8fa
-
SHA256
aebff5134e07a1586b911271a49702c8623b8ac8da2c135d4d3b0145a826f507
-
SHA512
5aaf241388dbb343e059af4a0cfd4d7507189f0c94f415ba9b9d87791e5f2bf81a780f73e2bbc8bb39f90edc779987eb422192fb3facb4c0dae78c140cacb787
-
SSDEEP
24576:FSfBk+9Zl7pC4HE+Y/lU/Z46vVJkWuQpJ53am1u46FxVDmdVxoejIF4UAVddHctD:6kFhgJ8m1u/CVxodFSfd+WC9J
Malware Config
Signatures
-
Detects PikaBot botnet 8 IoCs
Processes:
resource yara_rule behavioral2/memory/3472-2-0x0000000000EA0000-0x0000000000EED000-memory.dmp family_pikabot_v2 behavioral2/memory/3472-4-0x0000000000EA0000-0x0000000000EED000-memory.dmp family_pikabot_v2 behavioral2/memory/3472-5-0x0000000000EA0000-0x0000000000EED000-memory.dmp family_pikabot_v2 behavioral2/memory/3472-7-0x0000000000EA0000-0x0000000000EED000-memory.dmp family_pikabot_v2 behavioral2/memory/3472-8-0x0000000000EA0000-0x0000000000EED000-memory.dmp family_pikabot_v2 behavioral2/memory/3472-9-0x0000000000EA0000-0x0000000000EED000-memory.dmp family_pikabot_v2 behavioral2/memory/3472-10-0x0000000000EA0000-0x0000000000EED000-memory.dmp family_pikabot_v2 behavioral2/memory/3472-12-0x0000000000EA0000-0x0000000000EED000-memory.dmp family_pikabot_v2 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 4492 set thread context of 3472 4492 rundll32.exe SearchProtocolHost.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exenetstat.exepid process 740 ipconfig.exe 4956 netstat.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
SearchProtocolHost.exepid process 3472 SearchProtocolHost.exe 3472 SearchProtocolHost.exe 3472 SearchProtocolHost.exe 3472 SearchProtocolHost.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
Processes:
rundll32.exepid process 4492 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
Processes:
whoami.exenetstat.exedescription pid process Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 2744 whoami.exe Token: SeDebugPrivilege 4956 netstat.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1660 wrote to memory of 4492 1660 rundll32.exe rundll32.exe PID 1660 wrote to memory of 4492 1660 rundll32.exe rundll32.exe PID 1660 wrote to memory of 4492 1660 rundll32.exe rundll32.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe PID 4492 wrote to memory of 3472 4492 rundll32.exe SearchProtocolHost.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Birdman\Birdman.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Birdman\Birdman.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\whoami.exewhoami.exe /all4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exeipconfig.exe /all4⤵
- Gathers network information
-
C:\Windows\SysWOW64\netstat.exenetstat.exe -aon4⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3472-2-0x0000000000EA0000-0x0000000000EED000-memory.dmpFilesize
308KB
-
memory/3472-4-0x0000000000EA0000-0x0000000000EED000-memory.dmpFilesize
308KB
-
memory/3472-5-0x0000000000EA0000-0x0000000000EED000-memory.dmpFilesize
308KB
-
memory/3472-7-0x0000000000EA0000-0x0000000000EED000-memory.dmpFilesize
308KB
-
memory/3472-8-0x0000000000EA0000-0x0000000000EED000-memory.dmpFilesize
308KB
-
memory/3472-9-0x0000000000EA0000-0x0000000000EED000-memory.dmpFilesize
308KB
-
memory/3472-10-0x0000000000EA0000-0x0000000000EED000-memory.dmpFilesize
308KB
-
memory/3472-12-0x0000000000EA0000-0x0000000000EED000-memory.dmpFilesize
308KB
-
memory/4492-0-0x0000000002940000-0x00000000029FD000-memory.dmpFilesize
756KB
-
memory/4492-1-0x0000000002AE0000-0x0000000002BB2000-memory.dmpFilesize
840KB
-
memory/4492-6-0x0000000002AE0000-0x0000000002BB2000-memory.dmpFilesize
840KB