cycbot | 6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167c

General

Target

6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe
Size

175KB
MD5

8a193cd4cfc50bd887b352dab909f750
SHA1

65370cf4d4816fe77d671702f46489e33efb1091
SHA256

6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167c
SHA512

d7e7654bf821d5e935ec67b1a4deb73f8afc26f06480f820888aabcdbf25fbd0f90c1e2d07a72ecded03bee6d71fcdb9c20b1d7f0931e9d3dabdae46c3d668f5
SSDEEP

3072:rrknrxCvhFS4Q0pCAIS73DzteyLOETAPEbkcyNCymr+0Wbt0q57Toy:Urwhw4Qd3C3DTLOEnxsl0q5Q

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

Processes:

resource	yara_rule
behavioral1/memory/2676-8-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/2772-19-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/1156-84-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/2772-202-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2772-2-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2676-7-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2676-8-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2772-19-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/1156-84-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2772-202-0x0000000000400000-0x000000000044B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe

description	pid	process	target process
PID 2772 wrote to memory of 2676	2772	6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe	6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe
PID 2772 wrote to memory of 2676	2772	6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe	6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe
PID 2772 wrote to memory of 2676	2772	6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe	6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe
PID 2772 wrote to memory of 2676	2772	6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe	6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe
PID 2772 wrote to memory of 1156	2772	6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe	6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe
PID 2772 wrote to memory of 1156	2772	6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe	6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe
PID 2772 wrote to memory of 1156	2772	6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe	6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe
PID 2772 wrote to memory of 1156	2772	6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe	6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe

C:\Users\Admin\AppData\Local\Temp\6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe
"C:\Users\Admin\AppData\Local\Temp\6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Local\Temp\6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe
  C:\Users\Admin\AppData\Local\Temp\6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2676
- C:\Users\Admin\AppData\Local\Temp\6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe
  C:\Users\Admin\AppData\Local\Temp\6e8f1b102637f688486a90c1aa7629433c4d01193662df5b523cd01df05b167cN.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\BBC3.5E3

Filesize
597B

MD5
b3d44b19dc8dd33c2339e59d795c4c4a

SHA1
b8e5fa8bd40cb087d63d82f22c4131aa2edcf9ae

SHA256
5c852d2df6b8cb053105798245a65472388a4eb2e97b5fecc941e60f5b3ea4ee

SHA512
619b8ac1be7c99b5493b620bae78c9b7388aca96b88e8460c8c5bcebaeae184b9a4649ffb588bc4b793d76e0e90980f74e24f7c503e19ac4df9984c45a130961

Download Submit
C:\Users\Admin\AppData\Roaming\BBC3.5E3

Filesize
1KB

MD5
1c48db174fe1e4a85cea4267a23e8583

SHA1
36a40f80923738a3af2db0f6eee90454a4e610be

SHA256
e8586ebb892a4c896cbf1336437846d56de2750935f339779eb1b6efe13a8a33

SHA512
df011c8b93ea484594e59de3dd9eefa217eed53320d353acfbc2e86de42ac639cd7e56b6f6188b14533db63b7c7190d085412f4033f329e5073447f6282643b9

Download Submit
C:\Users\Admin\AppData\Roaming\BBC3.5E3

Filesize
897B

MD5
b4b334a8c0bb4563dac2bfd087e92030

SHA1
f6ab8d8ee21a38e0ad0e2623012f9076f648cf3a

SHA256
4676c684693e86bbfc2e49d34ccc7e27cff9193b570d1c05e884ec4ef3ebaa24

SHA512
f723dd8b3c8b0963c4af41f2e471f12c5b161b308cea0b5c7623e2f28dde2f5af713204d07267f99b409d64a7a895db2cfcddc087329e7aa1270dd9418adb328

Download Submit
C:\Users\Admin\AppData\Roaming\BBC3.5E3

Filesize
1KB

MD5
89552e4c2fe3056e1bb763347042a1a8

SHA1
742aa40a53005f321d4df13659600584329d8d48

SHA256
f162bc3529c09707bdafcc1748ac3515793b14f238fc7e54fe7f03c3e5e4eb13

SHA512
1d07bc3a9ed72300366d57fc400fc6119ec47041fce05ea2d203d8c9879d59d2bedff3c22b2df4054559e30d0add236452d8092b8ba2f8e720354da6d5035198

Download Submit
memory/1156-84-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2676-7-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2676-8-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2772-1-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2772-2-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2772-19-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2772-202-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads