Analysis
- max time kernel
138s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system - submitted
26/07/2024, 12:06
Static task
static1
Behavioral task
behavioral1
Sample
04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe
Resource
win7-20240705-en
windows7-x64
1 signatures
150 seconds
General
- Target 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe
- Size 1.4MB
- Sample240726-n91heazfqa
- SHA256 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384
- MD5 b7e3cd0eef8a00eb7c6a916386e7ee0e
- SHA1 44844b02c42585da9ab37e439dc0a87c7a4e2f62
- SHA512 b21d3fcf7746383a17c80aaeeedb69862e0c214c3229d48961ca5b11be18e8e2ebf4e5cd554d6a80fcd80929ce3937ae38880e3f10e67f5336e5afacc0585df2
- SSDEEP 24576:03dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6:3mYqHU7pHYY00VcCDdowG3tMa6
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
pikabot
C2
-
https://109.199.99.131:13721
-
https://154.38.175.241:13721
-
https://148.113.141.220:2224
-
https://23.226.138.143:2083
-
https://89.117.23.186:5686
-
https://23.226.138.161:5242
-
https://103.82.243.5:13721
-
https://145.239.135.24:5243
-
https://185.179.217.216:9785
-
https://154.12.248.41:5000
-
https://178.18.246.136:2078
-
https://141.95.106.106:2967
-
https://104.129.55.105:2223
-
https://57.128.165.176:13721
-
https://89.117.23.185:2221
-
https://86.38.225.106:2221
-
https://37.60.242.86:2967
-
https://37.60.242.85:9785
-
https://89.117.23.34:5938
-
https://154.12.233.66:2224
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1000 set thread context of 4740 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 94 - Program crash 1 IoCs
pid pid_target Process procid_target 4736 1000 WerFault.exe 82 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ctfmon.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1000 wrote to memory of 4740 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 94 PID 1000 wrote to memory of 4740 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 94 PID 1000 wrote to memory of 4740 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 94 PID 1000 wrote to memory of 4740 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 94 PID 1000 wrote to memory of 4740 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 94 PID 1000 wrote to memory of 4740 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 94 PID 1000 wrote to memory of 4740 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 94 PID 1000 wrote to memory of 4740 1000 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe"C:\Users\Admin\AppData\Local\Temp\04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\ctfmon.exe"C:\Windows\SysWOW64\ctfmon.exe -p 1234"2⤵
- System Location Discovery: System Language Discovery
PID:4740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 4922⤵
- Program crash
PID:4736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1000 -ip 10001⤵PID:3640