Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
submitted
02-04-2024 09:57
Static task
static1
Behavioral task
behavioral1
Sample
ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
General
Malware Config
Extracted
Family
pikabot
C2
https://109.199.99.131:13721
https://154.38.175.241:13721
https://148.113.141.220:2224
https://23.226.138.143:2083
https://89.117.23.186:5686
https://23.226.138.161:5242
https://103.82.243.5:13721
https://145.239.135.24:5243
https://185.179.217.216:9785
https://154.12.248.41:5000
https://178.18.246.136:2078
https://141.95.106.106:2967
https://104.129.55.105:2223
https://57.128.165.176:13721
https://89.117.23.185:2221
https://86.38.225.106:2221
https://37.60.242.86:2967
https://37.60.242.85:9785
https://89.117.23.34:5938
https://154.12.233.66:2224
Signatures
-
Pikabot family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2044 set thread context of 3068 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 96 -
Program crash 1 IoCs
pid pid_target Process procid_target 4448 2044 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ctfmon.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2044 wrote to memory of 3068 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 96 PID 2044 wrote to memory of 3068 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 96 PID 2044 wrote to memory of 3068 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 96 PID 2044 wrote to memory of 3068 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 96 PID 2044 wrote to memory of 3068 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 96 PID 2044 wrote to memory of 3068 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 96 PID 2044 wrote to memory of 3068 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 96 PID 2044 wrote to memory of 3068 2044 ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe"C:\Users\Admin\AppData\Local\Temp\ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\ctfmon.exe"C:\Windows\SysWOW64\ctfmon.exe -p 1234"2⤵
- System Location Discovery: System Language Discovery
PID:3068
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 4962⤵
- Program crash
PID:4448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2044 -ip 20441⤵PID:4788