Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 03:43
Static task
static1
Behavioral task
behavioral1
Sample
6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe
Resource
win7-20240708-en
General
-
Target
6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe
-
Size
1.4MB
-
MD5
7e31c0c1e7d7e9a1a7812403e0f9eb80
-
SHA1
fc3b216c10c744faa1e2aeacc153bb35c276baac
-
SHA256
6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f
-
SHA512
3f9f6073b38134ec221f1968b08eb65ccbb9d820d0921a68e9e49fb3dfdac7cf7b7b75d9d3e968d0f8c0f34c69ca56283a1e33fd12f2a9ef99bb201ea0264fe6
-
SSDEEP
24576:p3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6:0mYqHU7pHYY00VcCDdowG3tMa6
Malware Config
Extracted
pikabot
https://109.199.99.131:13721
https://154.38.175.241:13721
https://148.113.141.220:2224
https://23.226.138.143:2083
https://89.117.23.186:5686
https://23.226.138.161:5242
https://103.82.243.5:13721
https://145.239.135.24:5243
https://185.179.217.216:9785
https://154.12.248.41:5000
https://178.18.246.136:2078
https://141.95.106.106:2967
https://104.129.55.105:2223
https://57.128.165.176:13721
https://89.117.23.185:2221
https://86.38.225.106:2221
https://37.60.242.86:2967
https://37.60.242.85:9785
https://89.117.23.34:5938
https://154.12.233.66:2224
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1016 set thread context of 1620 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 94 -
Program crash 1 IoCs
pid pid_target Process procid_target 1464 1016 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ctfmon.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1016 wrote to memory of 1620 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 94 PID 1016 wrote to memory of 1620 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 94 PID 1016 wrote to memory of 1620 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 94 PID 1016 wrote to memory of 1620 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 94 PID 1016 wrote to memory of 1620 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 94 PID 1016 wrote to memory of 1620 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 94 PID 1016 wrote to memory of 1620 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 94 PID 1016 wrote to memory of 1620 1016 6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe"C:\Users\Admin\AppData\Local\Temp\6efdd236c9997e347a778d3778389739e3dd448f140e506d7229cbce3fe43f1f.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\ctfmon.exe"C:\Windows\SysWOW64\ctfmon.exe -p 1234"2⤵
- System Location Discovery: System Language Discovery
PID:1620
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 4922⤵
- Program crash
PID:1464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1016 -ip 10161⤵PID:3332