Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
46s -
max time network
64s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
submitted
25/03/2024, 18:30
General
Malware Config
Extracted
Family
pikabot
C2
https://141.95.106.106:2967
https://198.44.187.12:2224
https://104.129.55.106:13719
https://154.12.233.66:2224
https://104.129.55.105:2223
https://37.60.242.85:9785
https://23.226.138.161:5242
https://145.239.135.24:5243
https://86.38.225.105:13721
https://85.239.243.155:5000
https://89.117.23.186:5686
https://23.226.138.143:2083
https://103.82.243.5:13721
https://89.117.23.185:2221
https://86.38.225.106:2221
https://57.128.165.176:13721
https://178.18.246.136:2078
https://154.12.248.41:5000
Signatures
-
Pikabot family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1328 set thread context of 2680 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 99 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ctfmon.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1328 wrote to memory of 2680 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 99 PID 1328 wrote to memory of 2680 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 99 PID 1328 wrote to memory of 2680 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 99 PID 1328 wrote to memory of 2680 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 99 PID 1328 wrote to memory of 2680 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 99 PID 1328 wrote to memory of 2680 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 99 PID 1328 wrote to memory of 2680 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 99 PID 1328 wrote to memory of 2680 1328 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe"C:\Users\Admin\AppData\Local\Temp\89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\ctfmon.exe"C:\Windows\SysWOW64\ctfmon.exe -p 1234"2⤵
- System Location Discovery: System Language Discovery
PID:2680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4316 --field-trial-handle=2276,i,1205556100727695622,5044463180471657307,262144 --variations-seed-version /prefetch:81⤵PID:1996