cycbot | e3a7576bcf3c4dbe622fee504f227b9277464a2052ec949f152da4217149f0ce

Analysis

max time kernel
140s
max time network
64s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
09/12/2024, 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

csrss.exe
Size

192KB
MD5

864a00dc8fb5fa5e012db37c02bc7885
SHA1

53e852f83632668b9d20a43014dce5e13b1ce9c9
SHA256

c1139525258f7bb519b02a7969a5c1a3494c084b73e3bbb7cda82587237a7cfe
SHA512

37b7bd106ef023eaf2de0e7fee16439db360e162bf33e6308c726cae26350785577f38eca2637f4853000fb7ffeef94e1671a0918d3f6edabd866d7e0550d9c7
SSDEEP

3072:eJ0idJvZLj1PC6XdOjQ93uoRCMqimiFCUoaN0CZSQBc5T+B7blSH70f0nA:9iDZLj1aAQjExnaQCHHQBcYR8H4g

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 2 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral3/memory/2524-91-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot
behavioral3/memory/2524-135-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/2524-2-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral3/memory/2524-91-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral3/memory/2524-135-0x0000000000400000-0x0000000000447000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe

C:\Users\Admin\AppData\Local\Temp\csrss.exe
"C:\Users\Admin\AppData\Local\Temp\csrss.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\67B7.373

Filesize
396B

MD5
6dab37d62b61ca4d507b5a3c9329e152

SHA1
86860bdcaeef896b2bf6a39f0849d5473ab2a6d4

SHA256
5e8640fb3157fc7d5f28bb39dd6540a0e4420383e0f87af4d21b1e2ba9b622fe

SHA512
5ddc1faf7b3da40ad75068fa0a1dc39aad967a896cfb7d66a379a01129daa09b81167c46f8e4ce840e6e2465e39ed9c2628842db006ae3ffd82c0704e702ba0b

Download Submit
C:\Users\Admin\AppData\Roaming\67B7.373

Filesize
1KB

MD5
3adf5bd24dae80874477f3b73eee51a4

SHA1
9721b6dde79c43e302e45a1c18c96e414f1bb73f

SHA256
6b3c50534a5fcc5b4e703d3bdbc228a6daf297d6f920aa1c2cb1dcecde9d470e

SHA512
12f60f3041d182b946a598cf552075d51d5ac431dee9604db99dbcb151c2da9c0415797d59330def8ea3aec66b4bec8729407b6b22fd11a1173e691c8da0fe43

Download Submit
C:\Users\Admin\AppData\Roaming\67B7.373

Filesize
1KB

MD5
b236a7097a08d668668ac833646614a5

SHA1
add346deecb74307ab6cfbbf2aad70b53e2b118a

SHA256
10e52c0b542ed0a262f998a4235b575d8f4c18d607c85372331e2a1aa052e828

SHA512
7d3ec624241806418c2f388bb43115cd2a65a0b1f10ae29e261d43143bf8843a2066f3c44dc5aa2b8add782e459deb892184145ad99f58122a4a13a8f023737c

Download Submit
memory/2524-1-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2524-2-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2524-91-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2524-135-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download