Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
22-02-2024 10:34
Behavioral task
behavioral1
Sample
Xjgkkltfdhdfhfjg.exe
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
General
-
Target
Xjgkkltfdhdfhfjg.exe
-
Size
3.3MB
-
MD5
2a3a840641803b101b86e0c321b0a5fe
-
SHA1
52bc3e121f44c4f9e71b43110f468886294c7fc2
-
SHA256
b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e
-
SHA512
00e9064564b7ff3acd0f76194dca7aa3d7124ff66b28fa2711908f6a1c013de781b89f6d8878f7f71e0176a3e4eee5b90a25e8338154ee580381741617464e57
-
SSDEEP
49152:zCXtvRXOhEc2MgyyuTEGQp8EamZaFChW7ZaxJmLufu4I:zCxRXOhEc2MgJHTp+isL1
Malware Config
Extracted
Family
pikabot
C2
141.95.106.106
104.129.55.106
104.129.55.105
23.226.138.161
145.239.135.24
85.239.243.155
23.226.138.143
57.128.165.176
178.18.246.136
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Xjgkkltfdhdfhfjg.exedescription pid process target process PID 5036 set thread context of 2552 5036 Xjgkkltfdhdfhfjg.exe ctfmon.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Xjgkkltfdhdfhfjg.exepid process 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe 5036 Xjgkkltfdhdfhfjg.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Xjgkkltfdhdfhfjg.exepid process 5036 Xjgkkltfdhdfhfjg.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
Processes:
Xjgkkltfdhdfhfjg.exepid process 5036 Xjgkkltfdhdfhfjg.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Xjgkkltfdhdfhfjg.exedescription pid process target process PID 5036 wrote to memory of 2552 5036 Xjgkkltfdhdfhfjg.exe ctfmon.exe PID 5036 wrote to memory of 2552 5036 Xjgkkltfdhdfhfjg.exe ctfmon.exe PID 5036 wrote to memory of 2552 5036 Xjgkkltfdhdfhfjg.exe ctfmon.exe PID 5036 wrote to memory of 2552 5036 Xjgkkltfdhdfhfjg.exe ctfmon.exe PID 5036 wrote to memory of 2552 5036 Xjgkkltfdhdfhfjg.exe ctfmon.exe PID 5036 wrote to memory of 2552 5036 Xjgkkltfdhdfhfjg.exe ctfmon.exe PID 5036 wrote to memory of 2552 5036 Xjgkkltfdhdfhfjg.exe ctfmon.exe PID 5036 wrote to memory of 2552 5036 Xjgkkltfdhdfhfjg.exe ctfmon.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xjgkkltfdhdfhfjg.exe"C:\Users\Admin\AppData\Local\Temp\Xjgkkltfdhdfhfjg.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ctfmon.exe"C:\Windows\SysWOW64\ctfmon.exe -p 1234"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2552-1-0x00000000009E0000-0x00000000009F8000-memory.dmpFilesize
96KB
-
memory/2552-7-0x00000000009E0000-0x00000000009F8000-memory.dmpFilesize
96KB
-
memory/5036-0-0x00000000025A0000-0x00000000025D4000-memory.dmpFilesize
208KB
-
memory/5036-4-0x00000000025A0000-0x00000000025D4000-memory.dmpFilesize
208KB