pikabot | a519b9d032a342985bfe1fa3f1244f1db6699805d7883139a8245eba1c2e5dab | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 16:03

Sharing

Report Analysis Logs

General

Target

9923.dll
Size

840KB
MD5

f6da6e194c429fe815f7d592688f3009
SHA1

6df03d98320c3877567a05efa94c52f828269e21
SHA256

28d318a64d06bd5c86c11002be6805ebd114600b2f1e28f136924668b915e77b
SHA512

20e73161b2615b207c1c61360db9283cb9aec8a1295ce03f1b34976a13ba3b6e992337ac6e39d51789eadeec8d7db322abc494e667f4f9f2c3f3a3642c9fd91c
SSDEEP

24576:ee9nfmpSVmL+Cf72yb1SFEtEfPmY4uRD7HpUMhOw8ghE:dBmpSVmLfCDfPJ4cDFPhmghE

Score

10^/10

pikabot botnet

Malware Config

Extracted

Family

pikabot

C2

154.53.55.165

158.247.240.58

154.12.236.248

Signatures

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 4356 set thread context of 772 4356 rundll32.exe ctfmon.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4136 4356 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe
4356	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

4356 rundll32.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

rundll32.exe

pid process

4356 rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4528 wrote to memory of 4356	4528	rundll32.exe	rundll32.exe
PID 4528 wrote to memory of 4356	4528	rundll32.exe	rundll32.exe
PID 4528 wrote to memory of 4356	4528	rundll32.exe	rundll32.exe
PID 4356 wrote to memory of 772	4356	rundll32.exe	ctfmon.exe
PID 4356 wrote to memory of 772	4356	rundll32.exe	ctfmon.exe
PID 4356 wrote to memory of 772	4356	rundll32.exe	ctfmon.exe
PID 4356 wrote to memory of 772	4356	rundll32.exe	ctfmon.exe
PID 4356 wrote to memory of 772	4356	rundll32.exe	ctfmon.exe
PID 4356 wrote to memory of 772	4356	rundll32.exe	ctfmon.exe
PID 4356 wrote to memory of 772	4356	rundll32.exe	ctfmon.exe
PID 4356 wrote to memory of 772	4356	rundll32.exe	ctfmon.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9923.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4528

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9923.dll,#1
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4356

C:\Windows\SysWOW64\ctfmon.exe
"C:\Windows\SysWOW64\ctfmon.exe -p 1234"
3⤵
PID:772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 628
3⤵
- Program crash
PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4356 -ip 4356
1⤵
PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/772-1-0x0000000000130000-0x0000000000149000-memory.dmp

Filesize
100KB

Download
memory/772-6-0x0000000000130000-0x0000000000149000-memory.dmp

Filesize
100KB

Download
memory/4356-0-0x0000000002020000-0x0000000002056000-memory.dmp

Filesize
216KB

Download
memory/4356-12-0x0000000002020000-0x0000000002056000-memory.dmp

Filesize
216KB

Download