pikabot | a833610afa0a6308a50a55b77f07a9043c3fceedf8ac23fc434b056a786e6d7f

General

Target

8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
Size

1.4MB
MD5

7a36e1ebf13b1950a75851bd95c6aabd
SHA1

68684e8fa82045bef1e132e0d4d9d215d4483c8f
SHA256

8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806
SHA512

0cd409b60d982cc549a91d9c7dd2b2b78ef169e0dbb0374f384cd8240cdc2078d29b6276d20994de1bbefffe499268b8941df87f00629b30ba8727f2f786dc0c
SSDEEP

24576:u3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6N:JmYqHU7pHYY00VcCDdowG3tMa6N

Score

10^/10

pikabot botnet

Malware Config

Extracted

Family

pikabot

C2

109.199.99.131

154.38.175.241

23.226.138.143

23.226.138.161

145.239.135.24

178.18.246.136

141.95.106.106

104.129.55.105

57.128.165.176

Signatures

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot

Suspicious use of SetThreadContext 1 IoCs

Processes:

8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe

description	pid	process	target process
PID 1452 set thread context of 4360	1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe	ctfmon.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1216 1452 WerFault.exe 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe

pid	pid_target	process	target process
1216	1452	WerFault.exe	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe

pid	process
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe

pid process

1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe

description	pid	process	target process
PID 1452 wrote to memory of 4360	1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe	ctfmon.exe
PID 1452 wrote to memory of 4360	1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe	ctfmon.exe
PID 1452 wrote to memory of 4360	1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe	ctfmon.exe
PID 1452 wrote to memory of 4360	1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe	ctfmon.exe
PID 1452 wrote to memory of 4360	1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe	ctfmon.exe
PID 1452 wrote to memory of 4360	1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe	ctfmon.exe
PID 1452 wrote to memory of 4360	1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe	ctfmon.exe
PID 1452 wrote to memory of 4360	1452	8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe	ctfmon.exe

C:\Users\Admin\AppData\Local\Temp\8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
"C:\Users\Admin\AppData\Local\Temp\8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\ctfmon.exe
"C:\Windows\SysWOW64\ctfmon.exe -p 1234"
2⤵
PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 496
2⤵
- Program crash
PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1452 -ip 1452
1⤵
PID:2936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3524 --field-trial-handle=2228,i,521073434451423547,2311651514500527526,262144 --variations-seed-version /prefetch:8
1⤵
PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1452-0-0x0000000002320000-0x0000000002353000-memory.dmp

Filesize
204KB

Download
memory/1452-12-0x0000000002320000-0x0000000002353000-memory.dmp

Filesize
204KB

Download
memory/4360-1-0x0000000000150000-0x0000000000169000-memory.dmp

Filesize
100KB

Download
memory/4360-6-0x0000000000150000-0x0000000000169000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads