cycbot | 67bc474fba12625f5fa89472f784d61d3fc233eab98227f6d1c54921cc18204e

General

Target

67bc474fba12625f5fa89472f784d61d3fc233eab98227f6d1c54921cc18204e.exe
Size

175KB
MD5

d05b7c90ed2ae56fa73cb421900ed293
SHA1

ba98ec9648bda5f3ed09ded67a1ef4c149c121da
SHA256

67bc474fba12625f5fa89472f784d61d3fc233eab98227f6d1c54921cc18204e
SHA512

53f5b8c34a0d7205ea91736708986a01ed2379c7c36ddc045e71b36e14407cb57a3e7dbdc5443d7a521db9fca7601872ed25522ab6cd648dda9610dcac854a99
SSDEEP

3072:XdF23o/kDbA3PMS6zknBXKr1lbQkpEFxwOMkHWKcrE+uTWTH4Cv:Ng3o8DblzknAr1lbd0w4Zj+r

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2924-14-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/1824-15-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/1824-81-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/1240-83-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot
behavioral1/memory/1824-190-0x0000000000400000-0x000000000046E000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	67bc474fba12625f5fa89472f784d61d3fc233eab98227f6d1c54921cc18204e.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1824-2-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2924-12-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2924-14-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/1824-15-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/1824-81-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/1240-83-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/1824-190-0x0000000000400000-0x000000000046E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	67bc474fba12625f5fa89472f784d61d3fc233eab98227f6d1c54921cc18204e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	67bc474fba12625f5fa89472f784d61d3fc233eab98227f6d1c54921cc18204e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	67bc474fba12625f5fa89472f784d61d3fc233eab98227f6d1c54921cc18204e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2924	1824	67bc474fba12625f5fa89472f784d61d3fc233eab98227f6d1c54921cc18204e.exe	30
PID 1824 wrote to memory of 2924	1824	67bc474fba12625f5fa89472f784d61d3fc233eab98227f6d1c54921cc18204e.exe	30
PID 1824 wrote to memory of 2924	1824	67bc474fba12625f5fa89472f784d61d3fc233eab98227f6d1c54921cc18204e.exe	30
PID 1824 wrote to memory of 2924	1824	67bc474fba12625f5fa89472f784d61d3fc233eab98227f6d1c54921cc18204e.exe	30
PID 1824 wrote to memory of 1240	1824	67bc474fba12625f5fa89472f784d61d3fc233eab98227f6d1c54921cc18204e.exe	32
PID 1824 wrote to memory of 1240	1824	67bc474fba12625f5fa89472f784d61d3fc233eab98227f6d1c54921cc18204e.exe	32
PID 1824 wrote to memory of 1240	1824	67bc474fba12625f5fa89472f784d61d3fc233eab98227f6d1c54921cc18204e.exe	32
PID 1824 wrote to memory of 1240	1824	67bc474fba12625f5fa89472f784d61d3fc233eab98227f6d1c54921cc18204e.exe	32

C:\Users\Admin\AppData\Local\Temp\67bc474fba12625f5fa89472f784d61d3fc233eab98227f6d1c54921cc18204e.exe
"C:\Users\Admin\AppData\Local\Temp\67bc474fba12625f5fa89472f784d61d3fc233eab98227f6d1c54921cc18204e.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Users\Admin\AppData\Local\Temp\67bc474fba12625f5fa89472f784d61d3fc233eab98227f6d1c54921cc18204e.exe
  C:\Users\Admin\AppData\Local\Temp\67bc474fba12625f5fa89472f784d61d3fc233eab98227f6d1c54921cc18204e.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2924
- C:\Users\Admin\AppData\Local\Temp\67bc474fba12625f5fa89472f784d61d3fc233eab98227f6d1c54921cc18204e.exe
  C:\Users\Admin\AppData\Local\Temp\67bc474fba12625f5fa89472f784d61d3fc233eab98227f6d1c54921cc18204e.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\56DC.FC4

Filesize
1KB

MD5
b18a32b444b3e6e4e92871d614839d16

SHA1
2035396c50c9594e648004af180058bbace02170

SHA256
b8732e894eb3dc39d62cbf86d94da4e1b09eba3a13a4e90454c62657ec3b41b7

SHA512
a01b055ef240e7f9c96953953110349691bd89ec74d37f09cca4e031c8d2572aafd2d9baff85ba4eed37a447ed2fa6705f052d2f4afce6610d34b36c3f13b2a3

Download Submit
C:\Users\Admin\AppData\Roaming\56DC.FC4

Filesize
600B

MD5
a9a0ff966adef0ad37a258d1c4fa6667

SHA1
7c1a33fae515665611782295355d8b3f53939866

SHA256
7aa64d0c6a4bf43c8427930e15e0abf6af1a1a1fdcb424742d9f52462e25505b

SHA512
821cc0d22fa8986a6db4562321ce3ea9e9f2361aae3ed839faac4dc166a142f623f4f1137964568faabdad0307dec7cc54bbfd1ba1f3c5c0ca114e2cdb6f2417

Download Submit
C:\Users\Admin\AppData\Roaming\56DC.FC4

Filesize
996B

MD5
bcb93e6ce4d6e5de532bff79e98ca4e1

SHA1
f3e862930355f2959536bad618479c97c9b4950a

SHA256
8e4146faa6fe618190dd478d2e5803646b9d93947bd5d272d26e90a85b6fd538

SHA512
26d4cfdb5bab8551ecaacf836a5f340dc473de4c03abd1eb83a6a8cbfea8018953b8a60fe11c89026263e756f8af4132cfcf7adf5417646e0e510eadb7689fee

Download Submit
memory/1240-83-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1824-1-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1824-2-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1824-15-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1824-81-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1824-190-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2924-12-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2924-14-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads