cycbot | eef10866ceedb9811123abf82db5941f7284367ced6460d04900f9dd5ceb22af

General

Target

eef10866ceedb9811123abf82db5941f7284367ced6460d04900f9dd5ceb22af.exe
Size

165KB
MD5

7285ebc9e86eda0cfa0d013fe2a0053d
SHA1

f484a8cf7d833ea31c8a3a6718d477be35eda989
SHA256

eef10866ceedb9811123abf82db5941f7284367ced6460d04900f9dd5ceb22af
SHA512

84af41f32ed12ad46cbbfbb2334ba208621adbd9fe3fa1f4901c168f13fcdac5b2c34f3165f9ac9365e40c28183241b12f9760d094931e1684d5d7b1620c27b5
SSDEEP

3072:EfkfcHxa/ZrtSBnZ+k2/d7V2g855t1dRTvydaDgA+XtZ4XV:akfcHxaRhS7+kId/85zLRxgAiZ4F

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2288-19-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1944-20-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2224-89-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1944-95-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1944-99-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	eef10866ceedb9811123abf82db5941f7284367ced6460d04900f9dd5ceb22af.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1944-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2288-17-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2288-19-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1944-20-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2224-87-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2224-89-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1944-95-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1944-99-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eef10866ceedb9811123abf82db5941f7284367ced6460d04900f9dd5ceb22af.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eef10866ceedb9811123abf82db5941f7284367ced6460d04900f9dd5ceb22af.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eef10866ceedb9811123abf82db5941f7284367ced6460d04900f9dd5ceb22af.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2288	1944	eef10866ceedb9811123abf82db5941f7284367ced6460d04900f9dd5ceb22af.exe	30
PID 1944 wrote to memory of 2288	1944	eef10866ceedb9811123abf82db5941f7284367ced6460d04900f9dd5ceb22af.exe	30
PID 1944 wrote to memory of 2288	1944	eef10866ceedb9811123abf82db5941f7284367ced6460d04900f9dd5ceb22af.exe	30
PID 1944 wrote to memory of 2288	1944	eef10866ceedb9811123abf82db5941f7284367ced6460d04900f9dd5ceb22af.exe	30
PID 1944 wrote to memory of 2224	1944	eef10866ceedb9811123abf82db5941f7284367ced6460d04900f9dd5ceb22af.exe	32
PID 1944 wrote to memory of 2224	1944	eef10866ceedb9811123abf82db5941f7284367ced6460d04900f9dd5ceb22af.exe	32
PID 1944 wrote to memory of 2224	1944	eef10866ceedb9811123abf82db5941f7284367ced6460d04900f9dd5ceb22af.exe	32
PID 1944 wrote to memory of 2224	1944	eef10866ceedb9811123abf82db5941f7284367ced6460d04900f9dd5ceb22af.exe	32

C:\Users\Admin\AppData\Local\Temp\eef10866ceedb9811123abf82db5941f7284367ced6460d04900f9dd5ceb22af.exe
"C:\Users\Admin\AppData\Local\Temp\eef10866ceedb9811123abf82db5941f7284367ced6460d04900f9dd5ceb22af.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\eef10866ceedb9811123abf82db5941f7284367ced6460d04900f9dd5ceb22af.exe
  C:\Users\Admin\AppData\Local\Temp\eef10866ceedb9811123abf82db5941f7284367ced6460d04900f9dd5ceb22af.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2288
- C:\Users\Admin\AppData\Local\Temp\eef10866ceedb9811123abf82db5941f7284367ced6460d04900f9dd5ceb22af.exe
  C:\Users\Admin\AppData\Local\Temp\eef10866ceedb9811123abf82db5941f7284367ced6460d04900f9dd5ceb22af.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\9B7C.68F

Filesize
597B

MD5
e3a98521c4e4e563326d377fd6af0125

SHA1
dc278b6df367b94217d546c080536c69d439731b

SHA256
e96f7b067ad0eaded60b841b1ca2ce79008285ad3ae62726e42f24ea1c93a28c

SHA512
a8ad6ba8160426503944a3276f17780ba8ab0e144721c38f28079bbbcd3409fdc58411363811028b471c6cd598a0c2a0b97a495b193087933e976db7274a139b

Download Submit
C:\Users\Admin\AppData\Roaming\9B7C.68F

Filesize
1KB

MD5
10ea293a2f355292870be54c6d502f80

SHA1
dbb73f628e0923738e6e67e61aaa8a5be3c3ccd7

SHA256
250d7cd0f9eec85b7331d5342f54da3d8160eabc9535ca87477bdcedaabab3cc

SHA512
1c2c62fb1e26f10228b77b2ea11696b4ae9bdbbf82a175696844d64af1f9844767a84dc6b8c95f371ef4129fd7870e990738666cc27570594fb8696f2534ba9b

Download Submit
C:\Users\Admin\AppData\Roaming\9B7C.68F

Filesize
897B

MD5
d53638727efff4de94812f957b8c9493

SHA1
972a846c5a113e09c5d5bd88ba7d79f57bb3e69d

SHA256
e4b29668a0a7b0e6f8d474d99cdda91f7c45bc73d13d1490cf5394613ed851a5

SHA512
89c92968079c46f5b2d4edac0b2d31607d38185615184c02f96e08595a93c4ba144b29c16b36d1d2ae852fe19a2572ad65b8331a9d37f2e136f891f273603e9a

Download Submit
C:\Users\Admin\AppData\Roaming\9B7C.68F

Filesize
1KB

MD5
1a72366ec322279aa77e4110af00e371

SHA1
06ddf8bf54a85fcc1de8c15483fa4d0b0f18b34b

SHA256
c633c5f544ea1e815c92b624b45c287982d9980377d8da7024a7089340eb7743

SHA512
f75c346d5be46100f88739348315426fc57de15731c24519a5f0a5ab1e359a19c42cf0b730de4ae27146c22f2600a1f49cf1c108d052f0e49ddfcd2794028760

Download Submit
memory/1944-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1944-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1944-99-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1944-20-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1944-95-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2224-89-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2224-87-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2288-19-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2288-17-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads