Malware Analysis Report

2024-12-07 03:14

Sample ID 241107-tpbw7sxrbl
Target b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN
SHA256 b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779b
Tags
discovery cycbot backdoor persistence rat spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779b

Threat Level: Known bad

The file b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN was found to be: Known bad.

Malicious Activity Summary

discovery cycbot backdoor persistence rat spyware stealer upx

Cycbot

Detects Cycbot payload

Modifies WinLogon for persistence

Cycbot family

Reads user/profile data of web browsers

UPX packed file

Program crash

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-07 16:13

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-07 16:13

Reported

2024-11-07 16:15

Platform

win10v2004-20241007-en

Max time kernel

94s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe

"C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2928 -ip 2928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 384

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 107.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 66.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 98.209.201.84.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-07 16:13

Reported

2024-11-07 16:15

Platform

win7-20240903-en

Max time kernel

111s

Max time network

63s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe"

Signatures

Cycbot

backdoor rat cycbot

Cycbot family

cycbot

Detects Cycbot payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe" C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2364 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe
PID 2364 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe
PID 2364 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe
PID 2364 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe
PID 2364 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe
PID 2364 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe
PID 2364 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe
PID 2364 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe

"C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe"

C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe

C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft

C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe

C:\Users\Admin\AppData\Local\Temp\b524fa136b68fb4db0e146de32fca9939e626df92bac81bbe3e507cf1734779bN.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp

Network

Country Destination Domain Proto
US 8.8.8.8:53 psfk.com udp
DE 35.158.87.123:80 psfk.com tcp
US 8.8.8.8:53 ossimulators.com udp
US 8.8.8.8:53 zonedg.com udp
US 8.8.8.8:53 zonedg.com udp
US 8.8.8.8:53 spam-detection.com udp
US 103.224.212.214:80 zonedg.com tcp
US 103.224.212.214:80 zonedg.com tcp
US 103.224.212.214:80 zonedg.com tcp
US 103.224.212.214:80 zonedg.com tcp
US 103.224.212.214:80 zonedg.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.180.4:80 www.google.com tcp
US 103.224.212.214:80 zonedg.com tcp
GB 142.250.180.4:80 www.google.com tcp
N/A 127.0.0.1:54303 tcp

Files

memory/2364-1-0x0000000000400000-0x000000000046E000-memory.dmp

memory/2364-2-0x0000000000400000-0x000000000046E000-memory.dmp

memory/836-12-0x0000000000400000-0x000000000046E000-memory.dmp

memory/836-14-0x0000000000400000-0x000000000046E000-memory.dmp

memory/2364-15-0x0000000000400000-0x000000000046E000-memory.dmp

C:\Users\Admin\AppData\Roaming\318C.CD8

MD5 97c3c5bcc95a4ba50614685db0976d40
SHA1 ce9b96870638e44c7e906f8ca84a36c26259374e
SHA256 26917a34ed7076877e7aede85000306266718478692bccd5b047d8ee159dcd0b
SHA512 91d27d9f27fa2e984fc36784afbef7390fcede41cd741210cfc56ff868b749fa09134f0bf0f27200257ff76c2093efa4d807c3b79e4665d323cce199f337e25e

memory/2364-74-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1664-76-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1664-79-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1664-78-0x0000000000400000-0x000000000046E000-memory.dmp

C:\Users\Admin\AppData\Roaming\318C.CD8

MD5 b3f0aa72ecc3e6bd7427bd4eb9dc640d
SHA1 d7e885ed279aaf401a44da37e89ca14a98c7086b
SHA256 d55ef7a527dcd1ec61326908a91e1285b1d6a81465b5db856a5b772a57c70df9
SHA512 56b369807c6d43a58267da4fad32992b12e82c6c70c1cd38b4fe57e423192401bf88c25c1f149cb1af4183262848e3f53861e53128bae67b0ea5d752497da7f1

C:\Users\Admin\AppData\Roaming\318C.CD8

MD5 5e009c3331125140b7afd652749bfa8d
SHA1 7d97750724df6329d42aca6dc2f04fcc9527d90a
SHA256 7b3ad6d7b3a9f4b86aa0c22d682bc2e677b1b125ac1645ade59509bc842c9452
SHA512 c373ac43d0890e0aebdcc2e8877f01d3345139d3ac6e1449cebcd0123f982334308f4f5eaa155ab33f27c2b9a67f5ea67c7748c4ebca4fe91e74502efde9a8e1

memory/2364-187-0x0000000000400000-0x000000000046E000-memory.dmp