Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2024 09:56
Static task
static1
Behavioral task
behavioral1
Sample
HJ.exe
Resource
win7-20240221-en
0 signatures
150 seconds
General
-
Target
HJ.exe
-
Size
1.4MB
-
MD5
7a36e1ebf13b1950a75851bd95c6aabd
-
SHA1
68684e8fa82045bef1e132e0d4d9d215d4483c8f
-
SHA256
8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806
-
SHA512
0cd409b60d982cc549a91d9c7dd2b2b78ef169e0dbb0374f384cd8240cdc2078d29b6276d20994de1bbefffe499268b8941df87f00629b30ba8727f2f786dc0c
-
SSDEEP
24576:u3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6N:JmYqHU7pHYY00VcCDdowG3tMa6N
Malware Config
Extracted
Family
pikabot
C2
109.199.99.131
154.38.175.241
23.226.138.143
23.226.138.161
145.239.135.24
178.18.246.136
141.95.106.106
104.129.55.105
57.128.165.176
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3500 set thread context of 1532 3500 HJ.exe 95 -
Program crash 1 IoCs
pid pid_target Process procid_target 4828 3500 WerFault.exe 84 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe 3500 HJ.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 3500 HJ.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3500 wrote to memory of 1532 3500 HJ.exe 95 PID 3500 wrote to memory of 1532 3500 HJ.exe 95 PID 3500 wrote to memory of 1532 3500 HJ.exe 95 PID 3500 wrote to memory of 1532 3500 HJ.exe 95 PID 3500 wrote to memory of 1532 3500 HJ.exe 95 PID 3500 wrote to memory of 1532 3500 HJ.exe 95 PID 3500 wrote to memory of 1532 3500 HJ.exe 95 PID 3500 wrote to memory of 1532 3500 HJ.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\HJ.exe"C:\Users\Admin\AppData\Local\Temp\HJ.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\ctfmon.exe"C:\Windows\SysWOW64\ctfmon.exe -p 1234"2⤵PID:1532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 4922⤵
- Program crash
PID:4828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3500 -ip 35001⤵PID:4008
Network
-
Remote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request72.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request9.66.18.2.in-addr.arpaIN PTRResponse9.66.18.2.in-addr.arpaIN PTRa2-18-66-9deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request218.110.86.104.in-addr.arpaIN PTRResponse218.110.86.104.in-addr.arpaIN PTRa104-86-110-218deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request0.205.248.87.in-addr.arpaIN PTRResponse0.205.248.87.in-addr.arpaIN PTRhttps-87-248-205-0lgwllnwnet
-
Remote address:8.8.8.8:53Request11.173.189.20.in-addr.arpaIN PTRResponse
-
46 B 1
-
260 B 5
-
260 B 5
-
322 B 7
-
260 B 5
-
260 B 5
-
208 B 4
-
72 B 158 B 1 1
DNS Request
28.118.140.52.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
72.32.126.40.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
104.219.191.52.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
103.169.127.40.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
206.23.85.13.in-addr.arpa
-
68 B 129 B 1 1
DNS Request
9.66.18.2.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
218.110.86.104.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
13.227.111.52.in-addr.arpa
-
71 B 116 B 1 1
DNS Request
0.205.248.87.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
11.173.189.20.in-addr.arpa