cycbot | 381a38685bf71e10a9b240c3ffa9c7e2af1a8f93a5276c40078cfd219fcb3502

General

Target

381a38685bf71e10a9b240c3ffa9c7e2af1a8f93a5276c40078cfd219fcb3502N.exe
Size

195KB
MD5

cedb60895a10252742060e1e99a38070
SHA1

3be121ff592a7479b5019ec92c351691bb3ffd12
SHA256

381a38685bf71e10a9b240c3ffa9c7e2af1a8f93a5276c40078cfd219fcb3502
SHA512

d0d3963913e27d7fb9ad1206a3564fb504d32cececfb3faf42b6556eb747ab5ddcbc808fb093932305342f9caf4daedfa1b2b4e0482a1dac0442a482bdfbfb2b
SSDEEP

3072:nrjhsOwbilBFoGKiZsEe+4k+ua41XUD1UtKVYLYgs+wdylBvoVLMvIzrHbxWCI:D2wZsjb36XUmsVY/lVoqwzrsr

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/4680-13-0x0000000000400000-0x0000000000471000-memory.dmp	family_cycbot
behavioral2/memory/4804-14-0x0000000000400000-0x0000000000471000-memory.dmp	family_cycbot
behavioral2/memory/3560-87-0x0000000000400000-0x0000000000471000-memory.dmp	family_cycbot
behavioral2/memory/4804-198-0x0000000000400000-0x0000000000471000-memory.dmp	family_cycbot

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4804-2-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral2/memory/4680-8-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral2/memory/4680-13-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral2/memory/4804-14-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral2/memory/3560-86-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral2/memory/3560-87-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral2/memory/4804-198-0x0000000000400000-0x0000000000471000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	381a38685bf71e10a9b240c3ffa9c7e2af1a8f93a5276c40078cfd219fcb3502N.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 4680	4804	381a38685bf71e10a9b240c3ffa9c7e2af1a8f93a5276c40078cfd219fcb3502N.exe	82
PID 4804 wrote to memory of 4680	4804	381a38685bf71e10a9b240c3ffa9c7e2af1a8f93a5276c40078cfd219fcb3502N.exe	82
PID 4804 wrote to memory of 4680	4804	381a38685bf71e10a9b240c3ffa9c7e2af1a8f93a5276c40078cfd219fcb3502N.exe	82
PID 4804 wrote to memory of 3560	4804	381a38685bf71e10a9b240c3ffa9c7e2af1a8f93a5276c40078cfd219fcb3502N.exe	88
PID 4804 wrote to memory of 3560	4804	381a38685bf71e10a9b240c3ffa9c7e2af1a8f93a5276c40078cfd219fcb3502N.exe	88
PID 4804 wrote to memory of 3560	4804	381a38685bf71e10a9b240c3ffa9c7e2af1a8f93a5276c40078cfd219fcb3502N.exe	88

C:\Users\Admin\AppData\Local\Temp\381a38685bf71e10a9b240c3ffa9c7e2af1a8f93a5276c40078cfd219fcb3502N.exe
"C:\Users\Admin\AppData\Local\Temp\381a38685bf71e10a9b240c3ffa9c7e2af1a8f93a5276c40078cfd219fcb3502N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Users\Admin\AppData\Local\Temp\381a38685bf71e10a9b240c3ffa9c7e2af1a8f93a5276c40078cfd219fcb3502N.exe
  C:\Users\Admin\AppData\Local\Temp\381a38685bf71e10a9b240c3ffa9c7e2af1a8f93a5276c40078cfd219fcb3502N.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  PID:4680
- C:\Users\Admin\AppData\Local\Temp\381a38685bf71e10a9b240c3ffa9c7e2af1a8f93a5276c40078cfd219fcb3502N.exe
  C:\Users\Admin\AppData\Local\Temp\381a38685bf71e10a9b240c3ffa9c7e2af1a8f93a5276c40078cfd219fcb3502N.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  PID:3560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\37D5.BD8

Filesize
1KB

MD5
b608e7d62bd6e4e4eff9c29449594d32

SHA1
6aa7cdbae0ec27b478f22a410263df7d41425d95

SHA256
d6ce57fadbffcd31c6fdaa120ae557a3770bc276511c3e0ba6ebebcfd5d614c0

SHA512
43fa736721875b012293293afc6eaee36b824035fd109f449345c8c02f1952cce67db7940c0e92e37ec070ac96b51bd787de2a75fef3ee4bf06ec77213ebc8cb

Download Submit
C:\Users\Admin\AppData\Roaming\37D5.BD8

Filesize
600B

MD5
8a7c23c7aae304f70faae78d08e98213

SHA1
cdc870b044932d7ad3e3da1365dd3d5da5485da0

SHA256
baf7788bc4e786fd96f111dd9811b0ac9ef2b30efabec7afcf65947747a4b712

SHA512
1b7a40de7b439cc0558616e36e69b0dff23cf2d9127bab9598e9270ecf4d82699c5fb7bb57bb75299167455d15e0c544aa8da47422a7255c7c785fad0f222cec

Download Submit
C:\Users\Admin\AppData\Roaming\37D5.BD8

Filesize
996B

MD5
cc15e91949d5b0afb86049dcfa6937b5

SHA1
e0f6a56763048b928dc5882548577d45ba790c90

SHA256
9387a832f0d8d1f34b09900d20e6b23c7b681470cc1b1b493f1f4610523bb85d

SHA512
995fe700e3feb11089a2f7c93521b8bef4cc34fabde1f41399dfb74ff53a13555d655a8d9d7de064ac3de3d8793bd4b7dc1935868a6a863ebab6dcbdac626d62

Download Submit
memory/3560-86-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3560-87-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4680-8-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4680-13-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4804-1-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4804-2-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4804-14-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4804-198-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download

Analysis

Sharing