pikabot | f635f614efe260dae8f643cf75b52e3061779c47fd049775bfe50817226bbdc0

General

Target

89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
Size

3.3MB
MD5

f316f291a2998d6bbce2674c8aa3f349
SHA1

bbe00380a62900c286d8506a040d99718dfd8932
SHA256

89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9
SHA512

84770262959e3b1470b324775e5d06665008b09f0f5de33eef02efab77a8a560b44d3a59668ab91294c79cf58ef026aa2ff5bd9b6199e6a0d5b295ff209ffe6b
SSDEEP

49152:DCXtvRXOhEc2MgyyuTEGQp8EamZaFChW7ZaxJmLufu4a:DCxRXOhEc2MgJHTp+isLf

Score

10^/10

pikabot botnet

Malware Config

Extracted

Family

pikabot

C2

141.95.106.106

104.129.55.106

104.129.55.105

23.226.138.161

145.239.135.24

85.239.243.155

23.226.138.143

57.128.165.176

178.18.246.136

Signatures

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot

Suspicious use of SetThreadContext 1 IoCs

Processes:

89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe

description	pid	process	target process
PID 3068 set thread context of 1612	3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe	ctfmon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe

pid	process
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe

pid process

3068 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe

pid process

3068 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe

description	pid	process	target process
PID 3068 wrote to memory of 1612	3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe	ctfmon.exe
PID 3068 wrote to memory of 1612	3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe	ctfmon.exe
PID 3068 wrote to memory of 1612	3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe	ctfmon.exe
PID 3068 wrote to memory of 1612	3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe	ctfmon.exe
PID 3068 wrote to memory of 1612	3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe	ctfmon.exe
PID 3068 wrote to memory of 1612	3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe	ctfmon.exe
PID 3068 wrote to memory of 1612	3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe	ctfmon.exe
PID 3068 wrote to memory of 1612	3068	89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe	ctfmon.exe

C:\Users\Admin\AppData\Local\Temp\89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe
"C:\Users\Admin\AppData\Local\Temp\89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\ctfmon.exe
  "C:\Windows\SysWOW64\ctfmon.exe -p 1234"
  2⤵
  PID:1612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-1-0x00000000009B0000-0x00000000009C8000-memory.dmp

Filesize
96KB

Download
memory/1612-7-0x00000000009B0000-0x00000000009C8000-memory.dmp

Filesize
96KB

Download
memory/3068-0-0x00000000025C0000-0x00000000025F4000-memory.dmp

Filesize
208KB

Download
memory/3068-3-0x00000000025C0000-0x00000000025F4000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads