pikabot | be63608b2dd6ef065d3db20b272d8128368b2baafe3db0943447ac3ba4071bc9

Resubmissions

22-02-2024 19:45

16-02-2024 04:40

max time kernel
289s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2024 19:45

Target

ffc39c3fdbe06c62d04f4853fd2f0dda2e745a2886776b2ee39418c53d764441.dll
Size

193KB
MD5

f5cea7d74d36624df4e136c6c74b30f0
SHA1

892f2bd2f7582a6a8a98bc5e8c3876f6ec7a5af0
SHA256

ffc39c3fdbe06c62d04f4853fd2f0dda2e745a2886776b2ee39418c53d764441
SHA512

b2f3be9f408057d10372f66ed81f69d75eb3ea8d4f321108e5faf7ad1ade3092f50d9c0719a410c744f60fa9481cad6285a581740cda48029389ca1d7ba4d460
SSDEEP

3072:fhVQkLSPB5/bhWll55++X1qxSKctXzFNI516skIprTf1vngLK/74:fhNLOBNcrPzqxfcrWrPkIpr/74

Score

10^/10

pikabot botnet

Family

pikabot

45.76.251.190

155.138.147.62

23.226.138.161

104.129.55.105

178.18.246.136

172.232.189.10

172.232.162.97

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot
Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 4316 set thread context of 4496 4316 regsvr32.exe ctfmon.exe

description	pid	process	target process
PID 4316 set thread context of 4496	4316	regsvr32.exe	ctfmon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

regsvr32.exe

pid process

4316 regsvr32.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

regsvr32.exe

pid process

4316 regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1208 wrote to memory of 4316	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 4316	1208	regsvr32.exe	regsvr32.exe
PID 1208 wrote to memory of 4316	1208	regsvr32.exe	regsvr32.exe
PID 4316 wrote to memory of 4496	4316	regsvr32.exe	ctfmon.exe
PID 4316 wrote to memory of 4496	4316	regsvr32.exe	ctfmon.exe
PID 4316 wrote to memory of 4496	4316	regsvr32.exe	ctfmon.exe
PID 4316 wrote to memory of 4496	4316	regsvr32.exe	ctfmon.exe
PID 4316 wrote to memory of 4496	4316	regsvr32.exe	ctfmon.exe
PID 4316 wrote to memory of 4496	4316	regsvr32.exe	ctfmon.exe
PID 4316 wrote to memory of 4496	4316	regsvr32.exe	ctfmon.exe
PID 4316 wrote to memory of 4496	4316	regsvr32.exe	ctfmon.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ffc39c3fdbe06c62d04f4853fd2f0dda2e745a2886776b2ee39418c53d764441.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\SysWOW64\ctfmon.exe
"C:\Windows\SysWOW64\ctfmon.exe -p 1234"
3⤵
PID:4496

memory/4496-0-0x0000000000380000-0x0000000000398000-memory.dmp

Filesize
96KB

Download
memory/4496-5-0x0000000000380000-0x0000000000398000-memory.dmp

Filesize
96KB

Download