pikabot | 83a3bf48e107fb7142f29b6a3d2fe0b78aca9e91a8f648f05c99af05827120e5

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 06:38

Target

a83f6e7a71d300c1f5dd457d848a9859eebef336b3447e5623c37fc8077fa42f.dll
Size

840KB
MD5

9f81f7463f720ee4de86ba4c7c5db8e1
SHA1

0a6559d54a477052ee309b4f78119627cb1dafab
SHA256

a83f6e7a71d300c1f5dd457d848a9859eebef336b3447e5623c37fc8077fa42f
SHA512

7d298c1a3ec9505c7de49a48d4af9a87a7d38d23795f48383659c5869d7337117398bbb8db0d4af6bbdce434c3868e314a3cb033c3b3593de2902c8d1856a06f
SSDEEP

24576:Me9nfmpSVmL+Cf72yb1SFEtEfPmY4uRD7HpUMhOw8ghE:rBmpSVmLfCDfPJ4cDFPhmghE

Score

10^/10

pikabot botnet

Family

pikabot

154.53.55.165

158.247.240.58

154.12.236.248

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 2648 set thread context of 1384 2648 rundll32.exe ctfmon.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4952 2648 WerFault.exe rundll32.exe

description	pid	process	target process
PID 2648 set thread context of 1384	2648	rundll32.exe	ctfmon.exe

pid	pid_target	process	target process
4952	2648	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

2648 rundll32.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

rundll32.exe

pid process

2648 rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3168 wrote to memory of 2648	3168	rundll32.exe	rundll32.exe
PID 3168 wrote to memory of 2648	3168	rundll32.exe	rundll32.exe
PID 3168 wrote to memory of 2648	3168	rundll32.exe	rundll32.exe
PID 2648 wrote to memory of 1384	2648	rundll32.exe	ctfmon.exe
PID 2648 wrote to memory of 1384	2648	rundll32.exe	ctfmon.exe
PID 2648 wrote to memory of 1384	2648	rundll32.exe	ctfmon.exe
PID 2648 wrote to memory of 1384	2648	rundll32.exe	ctfmon.exe
PID 2648 wrote to memory of 1384	2648	rundll32.exe	ctfmon.exe
PID 2648 wrote to memory of 1384	2648	rundll32.exe	ctfmon.exe
PID 2648 wrote to memory of 1384	2648	rundll32.exe	ctfmon.exe
PID 2648 wrote to memory of 1384	2648	rundll32.exe	ctfmon.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a83f6e7a71d300c1f5dd457d848a9859eebef336b3447e5623c37fc8077fa42f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3168

C:\Windows\SysWOW64\ctfmon.exe
"C:\Windows\SysWOW64\ctfmon.exe -p 1234"
3⤵
PID:1384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 628
3⤵
- Program crash
PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2648 -ip 2648
1⤵
PID:2120

memory/1384-1-0x0000000000A20000-0x0000000000A39000-memory.dmp

Filesize
100KB

Download
memory/1384-6-0x0000000000A20000-0x0000000000A39000-memory.dmp

Filesize
100KB

Download
memory/2648-0-0x00000000028B0000-0x00000000028E6000-memory.dmp

Filesize
216KB

Download
memory/2648-12-0x00000000028B0000-0x00000000028E6000-memory.dmp

Filesize
216KB

Download