Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02/04/2024, 09:57
Static task
static1
Behavioral task
behavioral1
Sample
cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
General
-
Target
cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe
-
Size
1.4MB
-
MD5
0e84652db2c0c15a346c3d5f5fd1eccb
-
SHA1
f5837512c4a9c6094e40bd8cb3e7fb883d46570d
-
SHA256
cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee
-
SHA512
0e7728b034e57ce74bb786ef203747239bc2e15b74f3e35c6b06889253e3d1eb6efcac812a1bade87ad53bad603c68dd35b924770a533bab1b94633fc0e55678
-
SSDEEP
24576:A3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6E:TmYqHU7pHYY00VcCDdowG3tMa6E
Malware Config
Extracted
Family
pikabot
C2
109.199.99.131
154.38.175.241
23.226.138.143
23.226.138.161
145.239.135.24
178.18.246.136
141.95.106.106
104.129.55.105
57.128.165.176
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3488 set thread context of 4552 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 96 -
Program crash 1 IoCs
pid pid_target Process procid_target 2796 3488 WerFault.exe 84 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3488 wrote to memory of 4552 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 96 PID 3488 wrote to memory of 4552 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 96 PID 3488 wrote to memory of 4552 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 96 PID 3488 wrote to memory of 4552 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 96 PID 3488 wrote to memory of 4552 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 96 PID 3488 wrote to memory of 4552 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 96 PID 3488 wrote to memory of 4552 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 96 PID 3488 wrote to memory of 4552 3488 cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe"C:\Users\Admin\AppData\Local\Temp\cd90e313fa18cc71c65f2c4db3c21ca33241359d6174c771bad2118c0abf8cee.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\ctfmon.exe"C:\Windows\SysWOW64\ctfmon.exe -p 1234"2⤵PID:4552
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 4962⤵
- Program crash
PID:2796
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3488 -ip 34881⤵PID:4820