Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2024 09:56
Static task
static1
Behavioral task
behavioral1
Sample
8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
General
-
Target
8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe
-
Size
1.4MB
-
MD5
7a36e1ebf13b1950a75851bd95c6aabd
-
SHA1
68684e8fa82045bef1e132e0d4d9d215d4483c8f
-
SHA256
8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806
-
SHA512
0cd409b60d982cc549a91d9c7dd2b2b78ef169e0dbb0374f384cd8240cdc2078d29b6276d20994de1bbefffe499268b8941df87f00629b30ba8727f2f786dc0c
-
SSDEEP
24576:u3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6N:JmYqHU7pHYY00VcCDdowG3tMa6N
Malware Config
Extracted
Family
pikabot
C2
109.199.99.131
154.38.175.241
23.226.138.143
23.226.138.161
145.239.135.24
178.18.246.136
141.95.106.106
104.129.55.105
57.128.165.176
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1452 set thread context of 4360 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 101 -
Program crash 1 IoCs
pid pid_target Process procid_target 1216 1452 WerFault.exe 90 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1452 wrote to memory of 4360 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 101 PID 1452 wrote to memory of 4360 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 101 PID 1452 wrote to memory of 4360 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 101 PID 1452 wrote to memory of 4360 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 101 PID 1452 wrote to memory of 4360 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 101 PID 1452 wrote to memory of 4360 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 101 PID 1452 wrote to memory of 4360 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 101 PID 1452 wrote to memory of 4360 1452 8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe"C:\Users\Admin\AppData\Local\Temp\8eab535445ef91400fa8776ac3cef4f06c71a60832b8699db1fbccf8aacd5806.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\ctfmon.exe"C:\Windows\SysWOW64\ctfmon.exe -p 1234"2⤵PID:4360
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 4962⤵
- Program crash
PID:1216
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1452 -ip 14521⤵PID:2936
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3524 --field-trial-handle=2228,i,521073434451423547,2311651514500527526,262144 --variations-seed-version /prefetch:81⤵PID:2640