Analysis
-
max time kernel
244s -
max time network
252s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23-02-2024 14:18
Static task
static1
Behavioral task
behavioral1
Sample
EK.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
600 seconds
General
-
Target
EK.exe
-
Size
1.4MB
-
MD5
ea47545ac9ca1b7915b8567c84ef6f47
-
SHA1
961f43b020e27b8bc66de92ca73c52759af78bb0
-
SHA256
60ffa2a4c96b8f2a95602fc190cabedf4c5860f8514a648b601f0a96fc6da7de
-
SHA512
0936ea4e1a926c8eee1614302077585aa60070b265e861be56da62aa2a6d7ecc823934b3bc833f00c7c884628b69a0f737e5bf21248b6328ab08891457ddc33e
-
SSDEEP
24576:D3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6O:2mYqHU7pHYY00VcCDdowG3tMa6O
Malware Config
Extracted
Family
pikabot
C2
109.199.99.131
154.38.175.241
23.226.138.143
23.226.138.161
145.239.135.24
178.18.246.136
141.95.106.106
104.129.55.105
57.128.165.176
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3168 set thread context of 1488 3168 EK.exe 90 -
Program crash 1 IoCs
pid pid_target Process procid_target 2260 3168 WerFault.exe 84 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe 3168 EK.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 3168 EK.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4448 taskmgr.exe Token: SeSystemProfilePrivilege 4448 taskmgr.exe Token: SeCreateGlobalPrivilege 4448 taskmgr.exe Token: 33 4448 taskmgr.exe Token: SeIncBasePriorityPrivilege 4448 taskmgr.exe -
Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe -
Suspicious use of SendNotifyMessage 45 IoCs
pid Process 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe 4448 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3168 wrote to memory of 1488 3168 EK.exe 90 PID 3168 wrote to memory of 1488 3168 EK.exe 90 PID 3168 wrote to memory of 1488 3168 EK.exe 90 PID 3168 wrote to memory of 1488 3168 EK.exe 90 PID 3168 wrote to memory of 1488 3168 EK.exe 90 PID 3168 wrote to memory of 1488 3168 EK.exe 90 PID 3168 wrote to memory of 1488 3168 EK.exe 90 PID 3168 wrote to memory of 1488 3168 EK.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\EK.exe"C:\Users\Admin\AppData\Local\Temp\EK.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\SysWOW64\ctfmon.exe"C:\Windows\SysWOW64\ctfmon.exe -p 1234"2⤵PID:1488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 4962⤵
- Program crash
PID:2260
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3168 -ip 31681⤵PID:1980
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4448