pikabot | 3e0d4b3790b294270efa2897cac74faf1931acc8379f7a7bca36bd066bce6b9c

General

Target

b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
Size

3.3MB
MD5

2a3a840641803b101b86e0c321b0a5fe
SHA1

52bc3e121f44c4f9e71b43110f468886294c7fc2
SHA256

b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e
SHA512

00e9064564b7ff3acd0f76194dca7aa3d7124ff66b28fa2711908f6a1c013de781b89f6d8878f7f71e0176a3e4eee5b90a25e8338154ee580381741617464e57
SSDEEP

49152:zCXtvRXOhEc2MgyyuTEGQp8EamZaFChW7ZaxJmLufu4I:zCxRXOhEc2MgJHTp+isL1

Score

10^/10

pikabot botnet

Malware Config

Extracted

Family

pikabot

C2

141.95.106.106

104.129.55.106

104.129.55.105

23.226.138.161

145.239.135.24

85.239.243.155

23.226.138.143

57.128.165.176

178.18.246.136

Signatures

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot

Suspicious use of SetThreadContext 1 IoCs

Processes:

b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe

description	pid	process	target process
PID 1880 set thread context of 4536	1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe	ctfmon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe

pid	process
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe

pid process

1880 b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe

pid process

1880 b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe

description	pid	process	target process
PID 1880 wrote to memory of 4536	1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe	ctfmon.exe
PID 1880 wrote to memory of 4536	1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe	ctfmon.exe
PID 1880 wrote to memory of 4536	1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe	ctfmon.exe
PID 1880 wrote to memory of 4536	1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe	ctfmon.exe
PID 1880 wrote to memory of 4536	1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe	ctfmon.exe
PID 1880 wrote to memory of 4536	1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe	ctfmon.exe
PID 1880 wrote to memory of 4536	1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe	ctfmon.exe
PID 1880 wrote to memory of 4536	1880	b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe	ctfmon.exe

C:\Users\Admin\AppData\Local\Temp\b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe
"C:\Users\Admin\AppData\Local\Temp\b025e37611168c0abcc446125a8bd7cb831625338434929febadfcc9cc4c816e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1880

C:\Windows\SysWOW64\ctfmon.exe
"C:\Windows\SysWOW64\ctfmon.exe -p 1234"
2⤵
PID:4536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1880-0-0x00000000025D0000-0x0000000002604000-memory.dmp

Filesize
208KB

Download
memory/1880-6-0x00000000025D0000-0x0000000002604000-memory.dmp

Filesize
208KB

Download
memory/4536-1-0x0000000000C00000-0x0000000000C18000-memory.dmp

Filesize
96KB

Download
memory/4536-7-0x0000000000C00000-0x0000000000C18000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads