Windows Analysis Report
pikabot_core.bin.exe

Overview

General Information

Sample name: pikabot_core.bin.exe
Analysis ID: 1431279
MD5: f207a52477086eaf27141c780530336d
SHA1: cb3ea1f333d8b80b5ddda33bb1366a46b22dbeaa
SHA256: ce742b7cc94a5c668116d343b6a9677523dc13b358294bba3cd248fba8b880da
Tags: exepikabot
Infos:

Detection

PikaBot
Score: 76
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Yara detected PikaBot
Contains functionality to check for running processes (XOR)
Contains functionality to call native functions
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
Program does not show much activity (idle)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Name Description Attribution Blogpost URLs Link
Pikabot Introducing Pikabot, an emerging malware family that comprises a downloader/installer, a loader, and a core backdoor component. Despite being in the early stages of development, it already demonstrates advanced techniques in evasion, injection, and anti-analysis. Notably, the loader component incorporates an array of sophisticated anti-debugging and anti-VM measures inspired by the open-source Al-Khaser project, while leveraging steganography to conceal its payload. Additionally, Pikabot utilizes a proprietary C2 framework and supports a diverse range of commands, encompassing host enumeration and advanced secondary payload injection options. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.pikabot

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: pikabot_core.bin.exe Avira: detected
Antivirus detection for URL or domain
Source: https://45.32.188.56/7 Avira URL Cloud: Label: malware
Source: https://45.32.188.56/ Avira URL Cloud: Label: malware
Source: https://45.32.188.56:2967/prosabbatical/4vPvU918g1sKCJV?Fummel=IFfKa&nonaccommodating=5veOCi&Leptome Avira URL Cloud: Label: malware
Source: https://45.32.188.56:2967/ Avira URL Cloud: Label: malware
Source: https://45.32.188.56:2967/al Avira URL Cloud: Label: malware
Multi AV Scanner detection for submitted file
Source: pikabot_core.bin.exe ReversingLabs: Detection: 50%
Uses 32bit PE files
Source: pikabot_core.bin.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: pikabot_core.bin.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 45.32.188.56:2967
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.188.56
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.188.56
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.188.56
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.188.56
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.188.56
Source: pikabot_core.bin.exe, 00000000.00000002.3242063777.0000000000B51000.00000004.00000020.00020000.00000000.sdmp, pikabot_core.bin.exe, 00000000.00000002.3242063777.0000000000B8F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://45.32.188.56/
Source: pikabot_core.bin.exe, 00000000.00000002.3242063777.0000000000B8F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://45.32.188.56/7
Source: pikabot_core.bin.exe, 00000000.00000002.3242063777.0000000000B51000.00000004.00000020.00020000.00000000.sdmp, pikabot_core.bin.exe, 00000000.00000002.3242063777.0000000000B8F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://45.32.188.56:2967/
Source: pikabot_core.bin.exe, 00000000.00000002.3242063777.0000000000B8F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://45.32.188.56:2967/al
Source: pikabot_core.bin.exe, 00000000.00000002.3242063777.0000000000B8F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://45.32.188.56:2967/prosabbatical/4vPvU918g1sKCJV?Fummel=IFfKa&nonaccommodating=5veOCi&Leptome
Contains functionality to call native functions
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0088C6E0 NtClose, 0_2_0088C6E0
Detected potential crypto function
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_00876489 0_2_00876489
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0085C49C 0_2_0085C49C
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0084F4EC 0_2_0084F4EC
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_00874222 0_2_00874222
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0086E233 0_2_0086E233
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0084843C 0_2_0084843C
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0085BC4A 0_2_0085BC4A
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0084DE57 0_2_0084DE57
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_00855661 0_2_00855661
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_00850279 0_2_00850279
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0085D07B 0_2_0085D07B
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0084E380 0_2_0084E380
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_00872B99 0_2_00872B99
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_00855BAF 0_2_00855BAF
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0084E7AA 0_2_0084E7AA
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0084FFD0 0_2_0084FFD0
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0084D1F2 0_2_0084D1F2
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_00861B3E 0_2_00861B3E
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0087AB3A 0_2_0087AB3A
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_00853B7B 0_2_00853B7B
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0085E6A6 0_2_0085E6A6
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_008448A8 0_2_008448A8
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_00871AA8 0_2_00871AA8
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0087D6BB 0_2_0087D6BB
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_00888EC9 0_2_00888EC9
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_008844DE 0_2_008844DE
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0087BAD0 0_2_0087BAD0
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0084B4DD 0_2_0084B4DD
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_00874CFE 0_2_00874CFE
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_008462FE 0_2_008462FE
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0085E809 0_2_0085E809
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0088B04C 0_2_0088B04C
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0086FA55 0_2_0086FA55
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0086027C 0_2_0086027C
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0087CBB5 0_2_0087CBB5
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_008669BB 0_2_008669BB
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_00886FD9 0_2_00886FD9
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_00885FE8 0_2_00885FE8
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_00857FEE 0_2_00857FEE
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0086D3ED 0_2_0086D3ED
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0084C1FB 0_2_0084C1FB
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_00870316 0_2_00870316
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_00877518 0_2_00877518
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_00851522 0_2_00851522
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_00882723 0_2_00882723
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0085252B 0_2_0085252B
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_00889547 0_2_00889547
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0086C968 0_2_0086C968
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: String function: 0088260D appears 33 times
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: String function: 008618D2 appears 78 times
Sample file is different than original file name gathered from version info
Source: pikabot_core.bin.exe Binary or memory string: OriginalFilename vs pikabot_core.bin.exe
Source: pikabot_core.bin.exe, 00000000.00000000.1997154668.000000000088F000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameSearchFilterHost.exe@ vs pikabot_core.bin.exe
Source: pikabot_core.bin.exe, 00000000.00000002.3241955420.000000000088F000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameSearchFilterHost.exe@ vs pikabot_core.bin.exe
Source: pikabot_core.bin.exe Binary or memory string: OriginalFilenameSearchFilterHost.exe@ vs pikabot_core.bin.exe
Uses 32bit PE files
Source: pikabot_core.bin.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: mal76.troj.evad.winEXE@1/0@0/1
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_00855BAF SetLastError,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification, 0_2_00855BAF
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Mutant created: \Sessions\1\BaseNamedObjects\{F0B9756B-5D50-4696-A969-4C9AF7B69188}
Source: pikabot_core.bin.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: pikabot_core.bin.exe ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: pikabot_core.bin.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
Contains functionality to check for running processes (XOR)
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: SetLastError,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification, 0_2_00855BAF
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0088C6E0 push dword ptr [0088D004h]; ret 0_2_0088C744
Found evasive API chain checking for process token information
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: pikabot_core.bin.exe, 00000000.00000002.3242063777.0000000000B99000.00000004.00000020.00020000.00000000.sdmp, pikabot_core.bin.exe, 00000000.00000002.3242063777.0000000000B51000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0085E4FD mov eax, dword ptr fs:[00000030h] 0_2_0085E4FD
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0085E511 mov eax, dword ptr fs:[00000030h] 0_2_0085E511
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_00850279 GetTokenInformation,GetProcessHeap,FindCloseChangeNotification, 0_2_00850279
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0084EC90 cpuid 0_2_0084EC90
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\pikabot_core.bin.exe Code function: 0_2_0084DA84 GetUserNameW, 0_2_0084DA84

Stealing of Sensitive Information
barindex
Yara detected PikaBot
Source: Yara match File source: pikabot_core.bin.exe, type: SAMPLE
Source: Yara match File source: 0.2.pikabot_core.bin.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.pikabot_core.bin.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.3241914669.0000000000841000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.1996832931.0000000000841000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected PikaBot
Source: Yara match File source: pikabot_core.bin.exe, type: SAMPLE
Source: Yara match File source: 0.2.pikabot_core.bin.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.pikabot_core.bin.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.3241914669.0000000000841000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.1996832931.0000000000841000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1431279 Sample: pikabot_core.bin.exe Startdate: 24/04/2024 Architecture: WINDOWS Score: 76 11 Antivirus detection for URL or domain 2->11 13 Antivirus / Scanner detection for submitted sample 2->13 15 Multi AV Scanner detection for submitted file 2->15 17 Yara detected PikaBot 2->17 5 pikabot_core.bin.exe 12 2->5         started        process3 dnsIp4 9 45.32.188.56, 2967 AS-CHOOPAUS United States 5->9 19 Contains functionality to check for running processes (XOR) 5->19 signatures5
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
45.32.188.56
 unknown United States
20473 AS-CHOOPAUS false