pikabot | cb0f3edc7178bb106bb934cae8d50162328feecb81b33c183bd8d26296cf1a88

General

Target

000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
Size

1.4MB
MD5

188e1dc92136a378a1c6dad95abc87c1
SHA1

94f851e2bac770cd574289aa1a2b5fc8fb331b49
SHA256

000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c
SHA512

a1d6fd727b29974398757daf982c306924ed65ecaf943ab408113f9575a87e94d6a3fb31abc22656cb6a32c7673bffd8f660c537df72a92f4219ac3873bf9269
SSDEEP

24576:o3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6:bmYqHU7pHYY00VcCDdowG3tMa6

Score

10^/10

pikabot botnet

Malware Config

Extracted

Family

pikabot

C2

109.199.99.131

154.38.175.241

23.226.138.143

23.226.138.161

145.239.135.24

178.18.246.136

141.95.106.106

104.129.55.105

57.128.165.176

Signatures

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot

Suspicious use of SetThreadContext 1 IoCs

Processes:

000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe

description	pid	process	target process
PID 408 set thread context of 3312	408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe	ctfmon.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4944 408 WerFault.exe 000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe

pid	pid_target	process	target process
4944	408	WerFault.exe	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe

pid	process
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe

pid process

408 000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe

description	pid	process	target process
PID 408 wrote to memory of 3312	408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe	ctfmon.exe
PID 408 wrote to memory of 3312	408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe	ctfmon.exe
PID 408 wrote to memory of 3312	408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe	ctfmon.exe
PID 408 wrote to memory of 3312	408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe	ctfmon.exe
PID 408 wrote to memory of 3312	408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe	ctfmon.exe
PID 408 wrote to memory of 3312	408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe	ctfmon.exe
PID 408 wrote to memory of 3312	408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe	ctfmon.exe
PID 408 wrote to memory of 3312	408	000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe	ctfmon.exe

C:\Users\Admin\AppData\Local\Temp\000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe
"C:\Users\Admin\AppData\Local\Temp\000ac83fe38ca68495fc023c4b449f86c9d71b9583e0a7b4713cdc246a67306c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:408

C:\Windows\SysWOW64\ctfmon.exe
"C:\Windows\SysWOW64\ctfmon.exe -p 1234"
2⤵
PID:3312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 492
2⤵
- Program crash
PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 408 -ip 408
1⤵
PID:1820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/408-0-0x00000000022F0000-0x0000000002323000-memory.dmp

Filesize
204KB

Download
memory/408-12-0x00000000022F0000-0x0000000002323000-memory.dmp

Filesize
204KB

Download
memory/3312-1-0x0000000001040000-0x0000000001059000-memory.dmp

Filesize
100KB

Download
memory/3312-6-0x0000000001040000-0x0000000001059000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads