pikabot | bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace

General

Target

bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
Size

1.4MB
MD5

fbd290164b013766679f8096fd974b53
SHA1

7365c77a7b7dff53579346359e9b0ec5b8ba8b06
SHA256

bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace
SHA512

0e2d1e6e4eacf5cd6e04715036760875e771dc342fbb46fdb3fd2748ba940ceac90e0bf16f3403b3d9626cc884631028b6d11446515d85913a5a61218687540d
SSDEEP

24576:60/wpWGxRsnyM3LF+0mlBnjs60nEisX1N9rm1Jo/13JQyjLc22dEaY7Unbya87CJ:n/wn0x3LFfmHnIZE9rm1Ji3hLc22dEa3

Score

10^/10

pikabot botnet

Malware Config

Extracted

Family

pikabot

C2

23.226.138.161

104.129.55.105

Signatures

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot

Suspicious use of SetThreadContext 1 IoCs

Processes:

bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe

description	pid	process	target process
PID 1208 set thread context of 656	1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe	ctfmon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe

pid	process
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe

pid process

1208 bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe

pid process

1208 bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe

description	pid	process	target process
PID 1208 wrote to memory of 656	1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe	ctfmon.exe
PID 1208 wrote to memory of 656	1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe	ctfmon.exe
PID 1208 wrote to memory of 656	1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe	ctfmon.exe
PID 1208 wrote to memory of 656	1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe	ctfmon.exe
PID 1208 wrote to memory of 656	1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe	ctfmon.exe
PID 1208 wrote to memory of 656	1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe	ctfmon.exe
PID 1208 wrote to memory of 656	1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe	ctfmon.exe
PID 1208 wrote to memory of 656	1208	bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe	ctfmon.exe

C:\Users\Admin\AppData\Local\Temp\bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe
"C:\Users\Admin\AppData\Local\Temp\bd879fb7fdde311c8fd7d48f402cf5de0b7772bc3f24bb78a357c978f8681ace.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\SysWOW64\ctfmon.exe
"C:\Windows\SysWOW64\ctfmon.exe -p 1234"
2⤵
PID:656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-1-0x00000000010C0000-0x00000000010D8000-memory.dmp

Filesize
96KB

Download
memory/656-8-0x00000000010C0000-0x00000000010D8000-memory.dmp

Filesize
96KB

Download
memory/1208-0-0x0000000002330000-0x0000000002363000-memory.dmp

Filesize
204KB

Download
memory/1208-4-0x0000000000590000-0x00000000005A3000-memory.dmp

Filesize
76KB

Download
memory/1208-6-0x0000000002330000-0x0000000002363000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads