pikabot | 6e4c6e8fcee2d72021ce2a9621614c7919ae71133d1a355365d1b1a21579d51f

Analysis

max time kernel
131s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-02-2024 13:58

Target

9dbe815e1095f14671ba41aefcaa7a6b.dll
Size

935KB
MD5

9dbe815e1095f14671ba41aefcaa7a6b
SHA1

ebc5eafbde6bce3d6829b322822dc5a2755778bb
SHA256

6e4c6e8fcee2d72021ce2a9621614c7919ae71133d1a355365d1b1a21579d51f
SHA512

79fa9f70c49d39db9b9031471ad18d3614c6bbd50e04f96b73920bc22362d3a3ab7bb5764bb66ec67f28b8afbeea65c8845ff28fdd34e79a90627eb403947f6b
SSDEEP

12288:2qOfdYcwbu2jfQXSw7iDDVScHBsgVitfm5tltS2cevnXi1I09sjjGEzU3A:Vs/ONf1w7sw8s9whtSVCXWs/GEgA

Score

10^/10

Family

pikabot

141.95.106.106

104.129.55.106

104.129.55.105

23.226.138.161

145.239.135.24

85.239.243.155

23.226.138.143

57.128.165.176

178.18.246.136

PikaBot
PikaBot is a botnet that is distributed similarly to Qakbot and written in c++.
botnet pikabot
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 4852 set thread context of 2632 4852 rundll32.exe ctfmon.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4312 4852 WerFault.exe rundll32.exe

description	pid	process	target process
PID 4852 set thread context of 2632	4852	rundll32.exe	ctfmon.exe

pid	pid_target	process	target process
4312	4852	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

4852 rundll32.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

rundll32.exe

pid process

4852 rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4928 wrote to memory of 4852	4928	rundll32.exe	rundll32.exe
PID 4928 wrote to memory of 4852	4928	rundll32.exe	rundll32.exe
PID 4928 wrote to memory of 4852	4928	rundll32.exe	rundll32.exe
PID 4852 wrote to memory of 2632	4852	rundll32.exe	ctfmon.exe
PID 4852 wrote to memory of 2632	4852	rundll32.exe	ctfmon.exe
PID 4852 wrote to memory of 2632	4852	rundll32.exe	ctfmon.exe
PID 4852 wrote to memory of 2632	4852	rundll32.exe	ctfmon.exe
PID 4852 wrote to memory of 2632	4852	rundll32.exe	ctfmon.exe
PID 4852 wrote to memory of 2632	4852	rundll32.exe	ctfmon.exe
PID 4852 wrote to memory of 2632	4852	rundll32.exe	ctfmon.exe
PID 4852 wrote to memory of 2632	4852	rundll32.exe	ctfmon.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9dbe815e1095f14671ba41aefcaa7a6b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4928

C:\Windows\SysWOW64\ctfmon.exe
"C:\Windows\SysWOW64\ctfmon.exe -p 1234"
3⤵
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 620
3⤵
- Program crash
PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4852 -ip 4852
1⤵
PID:872

memory/2632-2-0x0000000000920000-0x0000000000938000-memory.dmp

Filesize
96KB

Download
memory/2632-7-0x0000000000920000-0x0000000000938000-memory.dmp

Filesize
96KB

Download
memory/4852-0-0x0000000003240000-0x000000000327C000-memory.dmp

Filesize
240KB

Download
memory/4852-1-0x00000000032C0000-0x00000000032F5000-memory.dmp

Filesize
212KB

Download
memory/4852-13-0x0000000000400000-0x00000000004EE000-memory.dmp

Filesize
952KB

Download
memory/4852-14-0x00000000032C0000-0x00000000032F5000-memory.dmp

Filesize
212KB

Download