pikabot | bb76c806b0dfea8a74b198753969ebb8b395c6986be7ca9f6bfd2ac80c3a848f

General

Target

ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
Size

1.4MB
MD5

d4651a1bb0851b8583ceddaa241e5335
SHA1

f58e15da8521a8459ef411d8c02598f728791fd0
SHA256

ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97
SHA512

5381118b8081b2c4fada15eb6ea848a81d28e286fb389e0616a5c9ce368c05a5a6868bc24a9d9a0fd0649e0541cce332fec0ae9d82a1840ec8fbcbe3bbbe1639
SSDEEP

24576:J3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6V:UmYqHU7pHYY00VcCDdowG3tMa6V

Score

10^/10

pikabot botnet

Malware Config

Extracted

Family

pikabot

C2

109.199.99.131

154.38.175.241

23.226.138.143

23.226.138.161

145.239.135.24

178.18.246.136

141.95.106.106

104.129.55.105

57.128.165.176

Signatures

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot

Suspicious use of SetThreadContext 1 IoCs

Processes:

ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe

description	pid	process	target process
PID 2044 set thread context of 3068	2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe	ctfmon.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4448 2044 WerFault.exe ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe

pid	pid_target	process	target process
4448	2044	WerFault.exe	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe

pid	process
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe

pid process

2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe

description	pid	process	target process
PID 2044 wrote to memory of 3068	2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe	ctfmon.exe
PID 2044 wrote to memory of 3068	2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe	ctfmon.exe
PID 2044 wrote to memory of 3068	2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe	ctfmon.exe
PID 2044 wrote to memory of 3068	2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe	ctfmon.exe
PID 2044 wrote to memory of 3068	2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe	ctfmon.exe
PID 2044 wrote to memory of 3068	2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe	ctfmon.exe
PID 2044 wrote to memory of 3068	2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe	ctfmon.exe
PID 2044 wrote to memory of 3068	2044	ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe	ctfmon.exe

C:\Users\Admin\AppData\Local\Temp\ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
"C:\Users\Admin\AppData\Local\Temp\ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\ctfmon.exe
"C:\Windows\SysWOW64\ctfmon.exe -p 1234"
2⤵
PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 496
2⤵
- Program crash
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2044 -ip 2044
1⤵
PID:4788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-0-0x0000000002310000-0x0000000002343000-memory.dmp

Filesize
204KB

Download
memory/2044-12-0x0000000002310000-0x0000000002343000-memory.dmp

Filesize
204KB

Download
memory/3068-1-0x00000000002F0000-0x0000000000309000-memory.dmp

Filesize
100KB

Download
memory/3068-6-0x00000000002F0000-0x0000000000309000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads