pikabot | d165c3a8a173f6ca5b05a9c407376cd3c694a023c20a065d72f60d1940c390bf

General

Target

fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
Size

1.4MB
MD5

6f21cb2e1cc2b7a411f3c1ec17476737
SHA1

152e4851a2dbb853c7d17a36575a470c59b5a805
SHA256

fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc
SHA512

15a9506519ab5b78cd31dfcae4757db83277ca7b3c4c9a0e72d517116dd2c2cc3c157d1591bb337ae713f9fc13f140b26a013e634e9a1270237de797fcaf2e4b
SSDEEP

24576:d3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6x:ImYqHU7pHYY00VcCDdowG3tMa6x

Score

10^/10

pikabot botnet

Malware Config

Extracted

Family

pikabot

C2

109.199.99.131

154.38.175.241

23.226.138.143

23.226.138.161

145.239.135.24

178.18.246.136

141.95.106.106

104.129.55.105

57.128.165.176

Signatures

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot

Suspicious use of SetThreadContext 1 IoCs

Processes:

fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe

description	pid	process	target process
PID 1420 set thread context of 732	1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe	ctfmon.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1056 1420 WerFault.exe fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe

pid	pid_target	process	target process
1056	1420	WerFault.exe	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe

pid	process
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe

pid process

1420 fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe

description	pid	process	target process
PID 1420 wrote to memory of 732	1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe	ctfmon.exe
PID 1420 wrote to memory of 732	1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe	ctfmon.exe
PID 1420 wrote to memory of 732	1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe	ctfmon.exe
PID 1420 wrote to memory of 732	1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe	ctfmon.exe
PID 1420 wrote to memory of 732	1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe	ctfmon.exe
PID 1420 wrote to memory of 732	1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe	ctfmon.exe
PID 1420 wrote to memory of 732	1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe	ctfmon.exe
PID 1420 wrote to memory of 732	1420	fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe	ctfmon.exe

C:\Users\Admin\AppData\Local\Temp\fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe
"C:\Users\Admin\AppData\Local\Temp\fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\ctfmon.exe
"C:\Windows\SysWOW64\ctfmon.exe -p 1234"
2⤵
PID:732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 496
2⤵
- Program crash
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4172 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1420 -ip 1420
1⤵
PID:3576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/732-2-0x0000000000E40000-0x0000000000E59000-memory.dmp

Filesize
100KB

Download
memory/732-7-0x0000000000E40000-0x0000000000E59000-memory.dmp

Filesize
100KB

Download
memory/1420-0-0x0000000002350000-0x0000000002383000-memory.dmp

Filesize
204KB

Download
memory/1420-1-0x0000000002350000-0x0000000002383000-memory.dmp

Filesize
204KB

Download
memory/1420-13-0x0000000002350000-0x0000000002383000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads