cycbot | e43ad0436de2e63421f23dcc16bccfc0cb229b86ff64ce1f44b1c5db4f453e85

General

Target

e43ad0436de2e63421f23dcc16bccfc0cb229b86ff64ce1f44b1c5db4f453e85.exe
Size

169KB
MD5

991d96d8c7baedda2df4ee1586a13f7c
SHA1

5c4b93c23cba17479c581b967bb2b8b63b37453c
SHA256

e43ad0436de2e63421f23dcc16bccfc0cb229b86ff64ce1f44b1c5db4f453e85
SHA512

c0652f7f7d8f67a2e1d4b1cd5e0c3c01626262ab050e8b380f330bfb0ad984347cefb645e2da872dcec2fe5378e8585ff22eceb8d22723a62e38b406fa73c415
SSDEEP

3072:pYtI3xw7+scZSKf9OnYqjbsYUdhV+ZF+Q0kx+p9s4lgUBS9Rh/duUkv:pP3xeNcZSKf9yYosXdhTksp9IdEl

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2092-14-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2100-15-0x0000000000400000-0x000000000048E000-memory.dmp	family_cycbot
behavioral1/memory/2100-16-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2100-79-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2092-80-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/3024-84-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral1/memory/2100-181-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\60BB8\\2543D.exe"	e43ad0436de2e63421f23dcc16bccfc0cb229b86ff64ce1f44b1c5db4f453e85.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2100-2-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2092-14-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2100-15-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2100-16-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2100-79-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2092-80-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/3024-82-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/3024-84-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2100-181-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e43ad0436de2e63421f23dcc16bccfc0cb229b86ff64ce1f44b1c5db4f453e85.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e43ad0436de2e63421f23dcc16bccfc0cb229b86ff64ce1f44b1c5db4f453e85.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e43ad0436de2e63421f23dcc16bccfc0cb229b86ff64ce1f44b1c5db4f453e85.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2092	2100	e43ad0436de2e63421f23dcc16bccfc0cb229b86ff64ce1f44b1c5db4f453e85.exe	31
PID 2100 wrote to memory of 2092	2100	e43ad0436de2e63421f23dcc16bccfc0cb229b86ff64ce1f44b1c5db4f453e85.exe	31
PID 2100 wrote to memory of 2092	2100	e43ad0436de2e63421f23dcc16bccfc0cb229b86ff64ce1f44b1c5db4f453e85.exe	31
PID 2100 wrote to memory of 2092	2100	e43ad0436de2e63421f23dcc16bccfc0cb229b86ff64ce1f44b1c5db4f453e85.exe	31
PID 2100 wrote to memory of 3024	2100	e43ad0436de2e63421f23dcc16bccfc0cb229b86ff64ce1f44b1c5db4f453e85.exe	33
PID 2100 wrote to memory of 3024	2100	e43ad0436de2e63421f23dcc16bccfc0cb229b86ff64ce1f44b1c5db4f453e85.exe	33
PID 2100 wrote to memory of 3024	2100	e43ad0436de2e63421f23dcc16bccfc0cb229b86ff64ce1f44b1c5db4f453e85.exe	33
PID 2100 wrote to memory of 3024	2100	e43ad0436de2e63421f23dcc16bccfc0cb229b86ff64ce1f44b1c5db4f453e85.exe	33

C:\Users\Admin\AppData\Local\Temp\e43ad0436de2e63421f23dcc16bccfc0cb229b86ff64ce1f44b1c5db4f453e85.exe
"C:\Users\Admin\AppData\Local\Temp\e43ad0436de2e63421f23dcc16bccfc0cb229b86ff64ce1f44b1c5db4f453e85.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\e43ad0436de2e63421f23dcc16bccfc0cb229b86ff64ce1f44b1c5db4f453e85.exe
  C:\Users\Admin\AppData\Local\Temp\e43ad0436de2e63421f23dcc16bccfc0cb229b86ff64ce1f44b1c5db4f453e85.exe startC:\Program Files (x86)\LP\2316\5D7.exe%C:\Program Files (x86)\LP\2316
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2092
- C:\Users\Admin\AppData\Local\Temp\e43ad0436de2e63421f23dcc16bccfc0cb229b86ff64ce1f44b1c5db4f453e85.exe
  C:\Users\Admin\AppData\Local\Temp\e43ad0436de2e63421f23dcc16bccfc0cb229b86ff64ce1f44b1c5db4f453e85.exe startC:\Program Files (x86)\B89CF\lvvm.exe%C:\Program Files (x86)\B89CF
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\60BB8\89CF.0BB

Filesize
1KB

MD5
6191d1339e5f528c282d522fddd888ee

SHA1
1575aa47a2dd8f5f17fb4b9dff906c4797fba1a9

SHA256
a9d67f86115e90dfb5f385abc9df548ca1fab9c249cf8538f4042baac39e3b2e

SHA512
164f1abf43401f285853b8abc60b5345ac5ffe84ab2225f7a11ea80c73e731ce98d8148791376de6ef01b33bfdd64dd0f002058341e2a6523a9016df30eadc75

Download Submit
C:\Users\Admin\AppData\Roaming\60BB8\89CF.0BB

Filesize
600B

MD5
5c831339dbd0f5461280b35944a34b50

SHA1
29abcafdb928828c5d7e328589a5b3e4effaca45

SHA256
66814c22be0b8b4cb07b412b023fc9de1a8920410f483924551dfac4ff70f031

SHA512
048564c7006f3ee73d2aca7f986ec65ed4f04e0968b61754ebf86e13afc58e52dda5754608644fefbc956eb1c097d736e2872ab8d78fd6664a4cf3f3e35b0248

Download Submit
C:\Users\Admin\AppData\Roaming\60BB8\89CF.0BB

Filesize
996B

MD5
97514819bf52ba127f669f6194c6e18e

SHA1
170226ff42b522465dbb32f91eaa56d17e8caf44

SHA256
617c544b1943c9cea8587eb9c802075d3b4a223539c799eaca88e0ad8e716833

SHA512
1d7df4c74a558b6c38cb536dcce73dad51b56722c9b6bff421103a7bff730eed728f71cf169c0c91cd1def9e146508c72b0807881be8122dee4c99a2515bcf9f

Download Submit
memory/2092-14-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2092-80-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2092-12-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2100-15-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2100-16-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2100-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2100-79-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2100-2-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2100-181-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/3024-82-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/3024-84-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads