pikabot | f937fef301af0179181c939e67d2e9f7e5d9eb61228ddd5f13d3bf58d9b500c4

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-02-2024 13:59

Target

9e41ab878ad1924c3f9f3cfef1c550cd.dll
Size

935KB
MD5

9e41ab878ad1924c3f9f3cfef1c550cd
SHA1

a46b433e5b93c86f711e60ce4e08a8da41ffa9a1
SHA256

f937fef301af0179181c939e67d2e9f7e5d9eb61228ddd5f13d3bf58d9b500c4
SHA512

d2822f5c8c1e9300079544d3df58a3982533b7a73bb84b995305897a71ee4d06934c419e60aca8b4021cfcd9c338d4dd6dd38276e0d5761af54993542f33b430
SSDEEP

12288:2qOfdYcwbu2jfQXSw7iDDVScHBsgVitfm5tltS2cevzXi1I09sjjGEzU3A:Vs/ONf1w7sw8s9whtSVCDWs/GEgA

Score

10^/10

pikabot botnet

Family

pikabot

141.95.106.106

104.129.55.106

104.129.55.105

23.226.138.161

145.239.135.24

85.239.243.155

23.226.138.143

57.128.165.176

178.18.246.136

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 4548 set thread context of 1848 4548 rundll32.exe ctfmon.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3484 4548 WerFault.exe rundll32.exe

description	pid	process	target process
PID 4548 set thread context of 1848	4548	rundll32.exe	ctfmon.exe

pid	pid_target	process	target process
3484	4548	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

4548 rundll32.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

rundll32.exe

pid process

4548 rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 220 wrote to memory of 4548	220	rundll32.exe	rundll32.exe
PID 220 wrote to memory of 4548	220	rundll32.exe	rundll32.exe
PID 220 wrote to memory of 4548	220	rundll32.exe	rundll32.exe
PID 4548 wrote to memory of 1848	4548	rundll32.exe	ctfmon.exe
PID 4548 wrote to memory of 1848	4548	rundll32.exe	ctfmon.exe
PID 4548 wrote to memory of 1848	4548	rundll32.exe	ctfmon.exe
PID 4548 wrote to memory of 1848	4548	rundll32.exe	ctfmon.exe
PID 4548 wrote to memory of 1848	4548	rundll32.exe	ctfmon.exe
PID 4548 wrote to memory of 1848	4548	rundll32.exe	ctfmon.exe
PID 4548 wrote to memory of 1848	4548	rundll32.exe	ctfmon.exe
PID 4548 wrote to memory of 1848	4548	rundll32.exe	ctfmon.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e41ab878ad1924c3f9f3cfef1c550cd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e41ab878ad1924c3f9f3cfef1c550cd.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\SysWOW64\ctfmon.exe
    "C:\Windows\SysWOW64\ctfmon.exe -p 1234"
    3⤵
    PID:1848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 620
    3⤵
    - Program crash
    PID:3484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4548 -ip 4548
1⤵
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3844 --field-trial-handle=2256,i,6057863739127169200,6895476048812676039,262144 --variations-seed-version /prefetch:8
1⤵
PID:2392

memory/1848-3-0x00000000012A0000-0x00000000012B8000-memory.dmp

Filesize
96KB

Download
memory/1848-8-0x00000000012A0000-0x00000000012B8000-memory.dmp

Filesize
96KB

Download
memory/4548-0-0x00000000020C0000-0x00000000021AE000-memory.dmp

Filesize
952KB

Download
memory/4548-1-0x0000000002630000-0x000000000266C000-memory.dmp

Filesize
240KB

Download
memory/4548-2-0x00000000026B0000-0x00000000026E5000-memory.dmp

Filesize
212KB

Download
memory/4548-14-0x00000000020C0000-0x00000000021AE000-memory.dmp

Filesize
952KB

Download
memory/4548-15-0x00000000026B0000-0x00000000026E5000-memory.dmp

Filesize
212KB

Download