Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2024 09:56
Static task
static1
Behavioral task
behavioral1
Sample
7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
General
-
Target
7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe
-
Size
1.4MB
-
MD5
cf4bc87ba864d0ebf69434b63e7ed59b
-
SHA1
43e104dc7fc474b0f1b7cc0814578b2505b2298b
-
SHA256
7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296
-
SHA512
9efe4af32cd8071f5b42efc21b5f96d97954ae942ce4f2ce93a7d654db619918608b18227ead2130faaf90872e4c7c6b2ce4956fd80669f1e31ddaa4404e89e4
-
SSDEEP
24576:P3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6s:SmYqHU7pHYY00VcCDdowG3tMa6s
Malware Config
Extracted
Family
pikabot
C2
109.199.99.131
154.38.175.241
23.226.138.143
23.226.138.161
145.239.135.24
178.18.246.136
141.95.106.106
104.129.55.105
57.128.165.176
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3308 set thread context of 2756 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 88 -
Program crash 1 IoCs
pid pid_target Process procid_target 3120 3308 WerFault.exe 84 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3308 wrote to memory of 2756 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 88 PID 3308 wrote to memory of 2756 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 88 PID 3308 wrote to memory of 2756 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 88 PID 3308 wrote to memory of 2756 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 88 PID 3308 wrote to memory of 2756 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 88 PID 3308 wrote to memory of 2756 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 88 PID 3308 wrote to memory of 2756 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 88 PID 3308 wrote to memory of 2756 3308 7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe"C:\Users\Admin\AppData\Local\Temp\7e4c7aab11985cb490f2792defcf57a11b4a5fb0d4410ba002439c540ce53296.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\ctfmon.exe"C:\Windows\SysWOW64\ctfmon.exe -p 1234"2⤵PID:2756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 4962⤵
- Program crash
PID:3120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3308 -ip 33081⤵PID:1648