pikabot | 0551101a6be6b0432f965d6a070871759ae79c1feacfc04d382a632a4566d35d

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2024 10:51

Target

1.exe
Size

3.3MB
MD5

9e5b3430d333c7c0a49fbb228c7fbd3a
SHA1

64b5657d9c06ae11fddbedb35e1bdda133436016
SHA256

0551101a6be6b0432f965d6a070871759ae79c1feacfc04d382a632a4566d35d
SHA512

2b3cf583522ac7e062d1fe06aab63c5409e6d4dfce138893f10de9742bec06fd8d4f212de73d2eefddbb34f4083ed4b5526f4472f55fcb8cbc8147f93356a76f
SSDEEP

49152:0CXtvRXOhEc2MgyyuTEGQp8EamZaFChW7ZaxJmLufu4J:0CxRXOhEc2MgJHTp+isLw

Score

10^/10

pikabot botnet

Family

pikabot

141.95.106.106

104.129.55.106

104.129.55.105

23.226.138.161

145.239.135.24

85.239.243.155

23.226.138.143

57.128.165.176

178.18.246.136

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot
Suspicious use of SetThreadContext 1 IoCs

Processes:

1.exe

description pid process target process

PID 396 set thread context of 1900 396 1.exe ctfmon.exe

description	pid	process	target process
PID 396 set thread context of 1900	396	1.exe	ctfmon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

1.exe

pid process

396 1.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

1.exe

pid process

396 1.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1.exe

description	pid	process	target process
PID 396 wrote to memory of 1900	396	1.exe	ctfmon.exe
PID 396 wrote to memory of 1900	396	1.exe	ctfmon.exe
PID 396 wrote to memory of 1900	396	1.exe	ctfmon.exe
PID 396 wrote to memory of 1900	396	1.exe	ctfmon.exe
PID 396 wrote to memory of 1900	396	1.exe	ctfmon.exe
PID 396 wrote to memory of 1900	396	1.exe	ctfmon.exe
PID 396 wrote to memory of 1900	396	1.exe	ctfmon.exe
PID 396 wrote to memory of 1900	396	1.exe	ctfmon.exe

C:\Windows\SysWOW64\ctfmon.exe
"C:\Windows\SysWOW64\ctfmon.exe -p 1234"
2⤵
PID:1900

memory/396-0-0x0000000002590000-0x00000000025C4000-memory.dmp

Filesize
208KB

Download
memory/396-4-0x0000000002590000-0x00000000025C4000-memory.dmp

Filesize
208KB

Download
memory/1900-1-0x00000000004E0000-0x00000000004F8000-memory.dmp

Filesize
96KB

Download
memory/1900-7-0x00000000004E0000-0x00000000004F8000-memory.dmp

Filesize
96KB

Download