pikabot | 158fdba70381175b6ee433de24f0802bef5de2b16965a68a88dde81092e0901b

General

Target

7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
Size

1.4MB
MD5

cf4bc87ba864d0ebf69434b63e7ed59b
SHA1

43e104dc7fc474b0f1b7cc0814578b2505b2298b
SHA256

7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296
SHA512

9efe4af32cd8071f5b42efc21b5f96d97954ae942ce4f2ce93a7d654db619918608b18227ead2130faaf90872e4c7c6b2ce4956fd80669f1e31ddaa4404e89e4
SSDEEP

24576:P3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6s:SmYqHU7pHYY00VcCDdowG3tMa6s

Score

10^/10

pikabot botnet

Malware Config

Extracted

Family

pikabot

C2

109.199.99.131

154.38.175.241

23.226.138.143

23.226.138.161

145.239.135.24

178.18.246.136

141.95.106.106

104.129.55.105

57.128.165.176

Signatures

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot

Suspicious use of SetThreadContext 1 IoCs

Processes:

7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe

description	pid	process	target process
PID 3308 set thread context of 2756	3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe	ctfmon.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3120 3308 WerFault.exe 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe

pid	pid_target	process	target process
3120	3308	WerFault.exe	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe

pid	process
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe

pid process

3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe

description	pid	process	target process
PID 3308 wrote to memory of 2756	3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe	ctfmon.exe
PID 3308 wrote to memory of 2756	3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe	ctfmon.exe
PID 3308 wrote to memory of 2756	3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe	ctfmon.exe
PID 3308 wrote to memory of 2756	3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe	ctfmon.exe
PID 3308 wrote to memory of 2756	3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe	ctfmon.exe
PID 3308 wrote to memory of 2756	3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe	ctfmon.exe
PID 3308 wrote to memory of 2756	3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe	ctfmon.exe
PID 3308 wrote to memory of 2756	3308	7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe	ctfmon.exe

C:\Users\Admin\AppData\Local\Temp\7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
"C:\Users\Admin\AppData\Local\Temp\7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3308

C:\Windows\SysWOW64\ctfmon.exe
"C:\Windows\SysWOW64\ctfmon.exe -p 1234"
2⤵
PID:2756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 496
2⤵
- Program crash
PID:3120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3308 -ip 3308
1⤵
PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2756-1-0x00000000012A0000-0x00000000012B9000-memory.dmp

Filesize
100KB

Download
memory/2756-6-0x00000000012A0000-0x00000000012B9000-memory.dmp

Filesize
100KB

Download
memory/3308-0-0x00000000022F0000-0x0000000002323000-memory.dmp

Filesize
204KB

Download
memory/3308-12-0x00000000022F0000-0x0000000002323000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads