pikabot | b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e

General

Target

b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
Size

3.3MB
MD5

2a3a840641803b101b86e0c321b0a5fe
SHA1

52bc3e121f44c4f9e71b43110f468886294c7fc2
SHA256

b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e
SHA512

00e9064564b7ff3acd0f76194dca7aa3d7124ff66b28fa2711908f6a1c013de781b89f6d8878f7f71e0176a3e4eee5b90a25e8338154ee580381741617464e57
SSDEEP

49152:zCXtvRXOhEc2MgyyuTEGQp8EamZaFChW7ZaxJmLufu4I:zCxRXOhEc2MgJHTp+isL1

Score

10^/10

pikabot botnet

Malware Config

Extracted

Family

pikabot

C2

141.95.106.106

104.129.55.106

104.129.55.105

23.226.138.161

145.239.135.24

85.239.243.155

23.226.138.143

57.128.165.176

178.18.246.136

Signatures

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot

Suspicious use of SetThreadContext 1 IoCs

Processes:

b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe

description	pid	process	target process
PID 2384 set thread context of 1404	2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe	ctfmon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe

pid	process
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe

pid process

2384 b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe

pid process

2384 b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe

description	pid	process	target process
PID 2384 wrote to memory of 1404	2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe	ctfmon.exe
PID 2384 wrote to memory of 1404	2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe	ctfmon.exe
PID 2384 wrote to memory of 1404	2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe	ctfmon.exe
PID 2384 wrote to memory of 1404	2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe	ctfmon.exe
PID 2384 wrote to memory of 1404	2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe	ctfmon.exe
PID 2384 wrote to memory of 1404	2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe	ctfmon.exe
PID 2384 wrote to memory of 1404	2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe	ctfmon.exe
PID 2384 wrote to memory of 1404	2384	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe	ctfmon.exe

C:\Users\Admin\AppData\Local\Temp\b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
"C:\Users\Admin\AppData\Local\Temp\b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:2384

C:\Windows\SysWOW64\ctfmon.exe
"C:\Windows\SysWOW64\ctfmon.exe -p 1234"
2⤵
PID:1404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1404-1-0x0000000000790000-0x00000000007A8000-memory.dmp

Filesize
96KB

Download
memory/1404-6-0x0000000000790000-0x00000000007A8000-memory.dmp

Filesize
96KB

Download
memory/2384-0-0x0000000002970000-0x00000000029A4000-memory.dmp

Filesize
208KB

Download
memory/2384-12-0x0000000002970000-0x00000000029A4000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads