pikabot | b1753ad48699afc4c28f25672981420aa32c24f84083f64a30d59020f5ea15ec

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 13:33

Target

238dcc5611ed9066b63d2d0109c9b623f54f8d7b61d5f9de59694cfc60a4e646.dll
Size

840KB
MD5

4b1518535af6344af39bd90aa02a6c0d
SHA1

183b74ec94b19c1f4af194e4d606270053669913
SHA256

238dcc5611ed9066b63d2d0109c9b623f54f8d7b61d5f9de59694cfc60a4e646
SHA512

8644ec984504f56336fe583c61f4e86c103550eb9f8cf27c6342251da13ef2d0dff132bd2256fbe8e1958da788e0f9738636e9b1438851784934427ec7006cb0
SSDEEP

24576:je9nfmpSVmL+Cf72yb1SFEtEfPmY4uRD7HpUMhOw8ghE:qBmpSVmLfCDfPJ4cDFPhmghE

Score

10^/10

pikabot botnet

Family

pikabot

154.53.55.165

158.247.240.58

154.12.236.248

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 3088 set thread context of 4588 3088 rundll32.exe ctfmon.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4836 3088 WerFault.exe rundll32.exe

description	pid	process	target process
PID 3088 set thread context of 4588	3088	rundll32.exe	ctfmon.exe

pid	pid_target	process	target process
4836	3088	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

3088 rundll32.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

rundll32.exe

pid process

3088 rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3356 wrote to memory of 3088	3356	rundll32.exe	rundll32.exe
PID 3356 wrote to memory of 3088	3356	rundll32.exe	rundll32.exe
PID 3356 wrote to memory of 3088	3356	rundll32.exe	rundll32.exe
PID 3088 wrote to memory of 4588	3088	rundll32.exe	ctfmon.exe
PID 3088 wrote to memory of 4588	3088	rundll32.exe	ctfmon.exe
PID 3088 wrote to memory of 4588	3088	rundll32.exe	ctfmon.exe
PID 3088 wrote to memory of 4588	3088	rundll32.exe	ctfmon.exe
PID 3088 wrote to memory of 4588	3088	rundll32.exe	ctfmon.exe
PID 3088 wrote to memory of 4588	3088	rundll32.exe	ctfmon.exe
PID 3088 wrote to memory of 4588	3088	rundll32.exe	ctfmon.exe
PID 3088 wrote to memory of 4588	3088	rundll32.exe	ctfmon.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\238dcc5611ed9066b63d2d0109c9b623f54f8d7b61d5f9de59694cfc60a4e646.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3356

C:\Windows\SysWOW64\ctfmon.exe
"C:\Windows\SysWOW64\ctfmon.exe -p 1234"
3⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 628
3⤵
- Program crash
PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3088 -ip 3088
1⤵
PID:432

memory/3088-0-0x0000000002B90000-0x0000000002BC6000-memory.dmp

Filesize
216KB

Download
memory/3088-12-0x0000000002B90000-0x0000000002BC6000-memory.dmp

Filesize
216KB

Download
memory/4588-1-0x0000000000C70000-0x0000000000C89000-memory.dmp

Filesize
100KB

Download
memory/4588-6-0x0000000000C70000-0x0000000000C89000-memory.dmp

Filesize
100KB

Download