cycbot | 6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0e

General

Target

6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe
Size

169KB
MD5

8d695065b48cae91f8e7056025063800
SHA1

5359d1daf782f09db642910a1b7b1f1cb5afbb9a
SHA256

6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0e
SHA512

6ee6ac208df510ba557e8266ae859c67f5702db479098648f55465f4c377f2e52b8c506476719667b62639a03fc14e59a0335fc3026e1aa234f2857294a5888a
SSDEEP

3072:NCa16ZDAPjlptCOFmZRmk5CW6MDTk9DDgNT6y5Bm3SA8uo:2GFHF6RJC10Tk93gNT15Bm3R8uo

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

Processes:

resource	yara_rule
behavioral1/memory/2508-13-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2508-15-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2408-16-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/2408-17-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2408-78-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2292-82-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2408-175-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\7EA2A\\ACAEA.exe"	6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2408-2-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2508-12-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2508-13-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2508-15-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2408-16-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2408-17-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2408-78-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2292-81-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2292-82-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2408-175-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe

description	pid	Process	procid_target
PID 2408 wrote to memory of 2508	2408	6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe	31
PID 2408 wrote to memory of 2508	2408	6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe	31
PID 2408 wrote to memory of 2508	2408	6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe	31
PID 2408 wrote to memory of 2508	2408	6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe	31
PID 2408 wrote to memory of 2292	2408	6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe	33
PID 2408 wrote to memory of 2292	2408	6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe	33
PID 2408 wrote to memory of 2292	2408	6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe	33
PID 2408 wrote to memory of 2292	2408	6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe	33

C:\Users\Admin\AppData\Local\Temp\6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe
"C:\Users\Admin\AppData\Local\Temp\6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe
  C:\Users\Admin\AppData\Local\Temp\6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe startC:\Program Files (x86)\LP\EA37\F8C.exe%C:\Program Files (x86)\LP\EA37
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2508
- C:\Users\Admin\AppData\Local\Temp\6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe
  C:\Users\Admin\AppData\Local\Temp\6cb546e19d1756da2fb7ec6f080693d3606d1b7ca1fff004a483353c81232e0eN.exe startC:\Program Files (x86)\2AB67\lvvm.exe%C:\Program Files (x86)\2AB67
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\7EA2A\AB67.EA2

Filesize
1KB

MD5
d6c34b2700befb8d03769d1a58eaa626

SHA1
89dcbec5203575c5369c249392fe6e8d70b2f658

SHA256
90feeb603fa25f92742ffb9b01553e1c6416b198624c3926b88779fdef2f9580

SHA512
16af3f792afe88a4f6e0503a906fb8a75b0cb0c89dd9f657d6f86cdb539522e356ed4e53244337583883fc1e1ac4767da375b3c275f884cb7eee59ac5ad942bd

Download Submit
C:\Users\Admin\AppData\Roaming\7EA2A\AB67.EA2

Filesize
600B

MD5
d93a8e6740d979d5dda3ef7f8d6e371b

SHA1
2c022456eb40656a04b557b5851c819d4785bdbb

SHA256
e34a5317fbd98a9c3b454b4ae0a1cc8e595ab4e6611b594122e715b1e073d4be

SHA512
6ba0354c45e075a10f6dc7a584d9ce209536b74de1dc80534e836050dcd27e7e4778f53be495cb77df70e0623dca73d139d5408012e57a075236dc8311ccc68a

Download Submit
C:\Users\Admin\AppData\Roaming\7EA2A\AB67.EA2

Filesize
996B

MD5
d97e8b479b8223ec13919d8be83e3877

SHA1
180e2f65acace10657931eaeacbefc365e017cd8

SHA256
17a4a2dbdf40a8285f9751da5201fe7bee742f71b0f7f1591c3da6e8062d6c7e

SHA512
095b87db21fa7b264df631fad0d8de668a0acc8ee86ecd02fec4eb194b4be6d5844780d0a551a8114bc939da56a922e541a7e7cd52711f202ebf5e69f5e9b758

Download Submit
memory/2292-82-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2292-81-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2292-80-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2408-16-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2408-17-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2408-78-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2408-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2408-2-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2408-175-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2508-15-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2508-11-0x00000000021D0000-0x00000000022D0000-memory.dmp

Filesize
1024KB

Download
memory/2508-13-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2508-12-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads