cycbot | 40776c58e14177edf86f34704c7dfd64977afe33fe6eb15af67c48727192dce4

General

Target

40776c58e14177edf86f34704c7dfd64977afe33fe6eb15af67c48727192dce4.exe
Size

176KB
MD5

0af30a7eb44ccfd5632bce6dac15cdd9
SHA1

fe1eb7393be58456d9e2044200b4813d9d1f669d
SHA256

40776c58e14177edf86f34704c7dfd64977afe33fe6eb15af67c48727192dce4
SHA512

15790ecb6edc2a19f929cdde9ed82158a3a238c651156a1d2282bf5d6fda5838b39819830e5b1edea150feade96b9944bc39b83325736c2af3b71c1e36109d24
SSDEEP

3072:bRC/UmzULMWQzL8+j+Fegyht8y7dTMiT5NrAvLs0pne8gRQL:NPmAMWKo+S0rv8ytMsrAvIbRQL

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 8 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2664-14-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/2664-13-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/1564-15-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/1564-89-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/1696-92-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/1564-161-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/1564-162-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/1564-165-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	40776c58e14177edf86f34704c7dfd64977afe33fe6eb15af67c48727192dce4.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1564-2-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2664-14-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2664-13-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1564-15-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1564-89-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1696-91-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1696-92-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1564-161-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1564-162-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1564-165-0x0000000000400000-0x000000000046C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40776c58e14177edf86f34704c7dfd64977afe33fe6eb15af67c48727192dce4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40776c58e14177edf86f34704c7dfd64977afe33fe6eb15af67c48727192dce4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40776c58e14177edf86f34704c7dfd64977afe33fe6eb15af67c48727192dce4.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 2664	1564	40776c58e14177edf86f34704c7dfd64977afe33fe6eb15af67c48727192dce4.exe	29
PID 1564 wrote to memory of 2664	1564	40776c58e14177edf86f34704c7dfd64977afe33fe6eb15af67c48727192dce4.exe	29
PID 1564 wrote to memory of 2664	1564	40776c58e14177edf86f34704c7dfd64977afe33fe6eb15af67c48727192dce4.exe	29
PID 1564 wrote to memory of 2664	1564	40776c58e14177edf86f34704c7dfd64977afe33fe6eb15af67c48727192dce4.exe	29
PID 1564 wrote to memory of 1696	1564	40776c58e14177edf86f34704c7dfd64977afe33fe6eb15af67c48727192dce4.exe	31
PID 1564 wrote to memory of 1696	1564	40776c58e14177edf86f34704c7dfd64977afe33fe6eb15af67c48727192dce4.exe	31
PID 1564 wrote to memory of 1696	1564	40776c58e14177edf86f34704c7dfd64977afe33fe6eb15af67c48727192dce4.exe	31
PID 1564 wrote to memory of 1696	1564	40776c58e14177edf86f34704c7dfd64977afe33fe6eb15af67c48727192dce4.exe	31

C:\Users\Admin\AppData\Local\Temp\40776c58e14177edf86f34704c7dfd64977afe33fe6eb15af67c48727192dce4.exe
"C:\Users\Admin\AppData\Local\Temp\40776c58e14177edf86f34704c7dfd64977afe33fe6eb15af67c48727192dce4.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Users\Admin\AppData\Local\Temp\40776c58e14177edf86f34704c7dfd64977afe33fe6eb15af67c48727192dce4.exe
  C:\Users\Admin\AppData\Local\Temp\40776c58e14177edf86f34704c7dfd64977afe33fe6eb15af67c48727192dce4.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2664
- C:\Users\Admin\AppData\Local\Temp\40776c58e14177edf86f34704c7dfd64977afe33fe6eb15af67c48727192dce4.exe
  C:\Users\Admin\AppData\Local\Temp\40776c58e14177edf86f34704c7dfd64977afe33fe6eb15af67c48727192dce4.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\55BA.709

Filesize
1KB

MD5
1dd08f530b9b0586543dc420484c4618

SHA1
aa0f1072e3f197dabebf06e20a4b6e3796420657

SHA256
7c72af47226a080a7ed261dbe6c376e6ef72f714523934755089ffac0a95919d

SHA512
896841871e1b711f84cfb133cf5ffc62c8355c205889d0a3dad58b9d07a70b7be6faab37fec31fbf56794277f3c8d686f1bd49423b143152e8020fbb961937ce

Download Submit
C:\Users\Admin\AppData\Roaming\55BA.709

Filesize
600B

MD5
a9de92d9c8b38adf3a0a844ccb71002c

SHA1
da2aa13c71ec55ddf713f8fa67a15680b7e3268d

SHA256
219825ebdc7bbbeece5aedc9f94111493bf3cf9f750bbc1744b41c960311c939

SHA512
f54fefbf8c9157d48e01f635c7a790061968158b407b2ce3d78b34769c322f07de50b4ea5f09886d5a2daa5af230ec9c6c9dad5f016432f9c22dae24ca8d1aa2

Download Submit
C:\Users\Admin\AppData\Roaming\55BA.709

Filesize
996B

MD5
9f9fbf8eb7f74a30ccca99c061f29d89

SHA1
92a7f6cbc49099ad7c62ca8944d225914400ce9a

SHA256
876df15544b0eb517c28b457392377b9726a47994ba2c6a579afa9c1f36d7f5e

SHA512
4e2a7ed9bd93dda3823b0cb8243d9ec5abaf66f83e7c16912d934b9db75c8823f64bcbe879a18ea7bf6e3fa47263c2e62755e8fb208ea80bb17bfc619ce62e02

Download Submit
memory/1564-2-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1564-165-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1564-162-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1564-161-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1564-15-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1564-89-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1564-1-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1696-92-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1696-91-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2664-12-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2664-13-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2664-14-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads