Analysis
- max time kernel
143s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
25/07/2024, 00:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
LisectAVT_2403002A_280.exe
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
General
- Target LisectAVT_2403002A_280.exe
- Size 1.3MB
- Sample240725-ak2saaygra
- SHA256 2a3b2ff71f16b23e21aa9855139553509476d9f80f99d509fe0ba2c66fb9acda
- MD5 6a4b5a1fc48d7a85fe0a1ee8290e42b7
- SHA1 45faa50e3f66880615ddc8dba97e0cffea61a55e
- SHA512 e429100ccca6bd84685c6b4990c75f01f8bc1b37666706bc345c865ad66b03f01cfa0ce6c73d9262f955dc02a3230ac5b1ca6da27983cc7530fdafe4a0f6e39c
- SSDEEP 12288:2jwHlbKaWY6oL1T0uwJ34dW/QtQF5KXGOTBwfRzPZ15HVCjkNMOuEFcd+wtZqA8s:2yHC/QtQF5kGXZPY+1BFc2AZoyLtkwx
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
pikabot
C2
-
https://158.220.95.214:5243
-
https://64.23.199.206:1194
-
https://172.232.208.90:2223
-
https://213.199.41.33:13721
-
https://194.233.91.144:5000
-
https://158.220.95.215:5242
-
https://84.247.157.112:13719
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4496 set thread context of 4036 4496 LisectAVT_2403002A_280.exe 93 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LisectAVT_2403002A_280.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ctfmon.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe 4496 LisectAVT_2403002A_280.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4496 LisectAVT_2403002A_280.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 4496 LisectAVT_2403002A_280.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4496 wrote to memory of 4036 4496 LisectAVT_2403002A_280.exe 93 PID 4496 wrote to memory of 4036 4496 LisectAVT_2403002A_280.exe 93 PID 4496 wrote to memory of 4036 4496 LisectAVT_2403002A_280.exe 93 PID 4496 wrote to memory of 4036 4496 LisectAVT_2403002A_280.exe 93 PID 4496 wrote to memory of 4036 4496 LisectAVT_2403002A_280.exe 93 PID 4496 wrote to memory of 4036 4496 LisectAVT_2403002A_280.exe 93 PID 4496 wrote to memory of 4036 4496 LisectAVT_2403002A_280.exe 93 PID 4496 wrote to memory of 4036 4496 LisectAVT_2403002A_280.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002A_280.exe"C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002A_280.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\ctfmon.exe"C:\Windows\SysWOW64\ctfmon.exe -p 1234"2⤵
- System Location Discovery: System Language Discovery
PID:4036
-