pikabot | 4c996915b63aea042d04db28b0ca8fd68cc3025cb488bc9572ec1d3dc6e50949

General

Target

cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
Size

1.4MB
MD5

0e84652db2c0c15a346c3d5f5fd1eccb
SHA1

f5837512c4a9c6094e40bd8cb3e7fb883d46570d
SHA256

cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee
SHA512

0e7728b034e57ce74bb786ef203747239bc2e15b74f3e35c6b06889253e3d1eb6efcac812a1bade87ad53bad603c68dd35b924770a533bab1b94633fc0e55678
SSDEEP

24576:A3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6E:TmYqHU7pHYY00VcCDdowG3tMa6E

Score

10^/10

pikabot botnet

Malware Config

Extracted

Family

pikabot

C2

109.199.99.131

154.38.175.241

23.226.138.143

23.226.138.161

145.239.135.24

178.18.246.136

141.95.106.106

104.129.55.105

57.128.165.176

Signatures

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot

Suspicious use of SetThreadContext 1 IoCs

Processes:

cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe

description	pid	process	target process
PID 3488 set thread context of 4552	3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe	ctfmon.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2796 3488 WerFault.exe cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe

pid	pid_target	process	target process
2796	3488	WerFault.exe	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe

pid	process
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe

pid process

3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe

description	pid	process	target process
PID 3488 wrote to memory of 4552	3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe	ctfmon.exe
PID 3488 wrote to memory of 4552	3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe	ctfmon.exe
PID 3488 wrote to memory of 4552	3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe	ctfmon.exe
PID 3488 wrote to memory of 4552	3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe	ctfmon.exe
PID 3488 wrote to memory of 4552	3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe	ctfmon.exe
PID 3488 wrote to memory of 4552	3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe	ctfmon.exe
PID 3488 wrote to memory of 4552	3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe	ctfmon.exe
PID 3488 wrote to memory of 4552	3488	cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe	ctfmon.exe

C:\Users\Admin\AppData\Local\Temp\cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
"C:\Users\Admin\AppData\Local\Temp\cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3488

C:\Windows\SysWOW64\ctfmon.exe
"C:\Windows\SysWOW64\ctfmon.exe -p 1234"
2⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 496
2⤵
- Program crash
PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3488 -ip 3488
1⤵
PID:4820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3488-0-0x00000000022F0000-0x0000000002323000-memory.dmp

Filesize
204KB

Download
memory/3488-12-0x00000000022F0000-0x0000000002323000-memory.dmp

Filesize
204KB

Download
memory/4552-1-0x0000000000A40000-0x0000000000A59000-memory.dmp

Filesize
100KB

Download
memory/4552-6-0x0000000000A40000-0x0000000000A59000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads