cycbot | 1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418

General

Target

1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418.exe
Size

187KB
MD5

daad9b133d139f509a2ef348da66c146
SHA1

1f8730c8bc7a0765e2f0983ae88f64838eb7fa84
SHA256

1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418
SHA512

a62c92899220125132b5805140d9f43af86e35537ef362e069bd8da592bc925a502e20c7b7d386cef09532667c7d39b1d785e293bdad39deeeba3be531cc62d2
SSDEEP

3072:umpgG33H1u5F79GNgPrnw+fg+UbH8eIA6EfI73VrarwObkeLpp+RuDN4o:mwHobkCbw+fAmdzLparwWLpgSGo

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2412-7-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/3000-15-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2456-77-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/3000-78-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/3000-185-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3000-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2412-7-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2412-5-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/3000-15-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2456-76-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2456-77-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/3000-78-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/3000-185-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2412	3000	1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418.exe	30
PID 3000 wrote to memory of 2412	3000	1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418.exe	30
PID 3000 wrote to memory of 2412	3000	1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418.exe	30
PID 3000 wrote to memory of 2412	3000	1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418.exe	30
PID 3000 wrote to memory of 2456	3000	1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418.exe	33
PID 3000 wrote to memory of 2456	3000	1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418.exe	33
PID 3000 wrote to memory of 2456	3000	1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418.exe	33
PID 3000 wrote to memory of 2456	3000	1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418.exe	33

C:\Users\Admin\AppData\Local\Temp\1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418.exe
"C:\Users\Admin\AppData\Local\Temp\1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418.exe
  C:\Users\Admin\AppData\Local\Temp\1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2412
- C:\Users\Admin\AppData\Local\Temp\1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418.exe
  C:\Users\Admin\AppData\Local\Temp\1b3a4ba95af464fc222df26f71c5c8c44b4beca002176ae5372471caf2bb2418.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\C43B.7BB

Filesize
1KB

MD5
2e87f0d1307d85a9f167fd89c46263f0

SHA1
ab6c017f95630402ae9634f0efd4cb3b29336e9c

SHA256
908b33bdba1340a0f9b07677ebe7970a8730947a148ba86d6f843d301d0084e3

SHA512
49915ba0d34c57845e1055aa1d54542508fae89ab1e5dddc77531cbee2a2ee8293b9c54275fc410e572a9d35633a90bdcb8d0066eaeadf8d252ad5543da1fc06

Download Submit
C:\Users\Admin\AppData\Roaming\C43B.7BB

Filesize
600B

MD5
80907817e64211b494d4b810c45ed5cd

SHA1
584819033350e1461e6d9c26642b2f9bd4d44ce4

SHA256
dc3dab4acc7e94911362f448f4c4576cda7a61eff37f049f7bbf597a814ba3a5

SHA512
6ea7c264e53cbf5c51bd136eee3997f2523c7dbf822d27eb97282ba598c0160d8e5b851cc12e8c1aa54912e2f43550270b51e37ffa52d84bd434058efc6bde0e

Download Submit
C:\Users\Admin\AppData\Roaming\C43B.7BB

Filesize
996B

MD5
d4e35a8cb9ba7b64dbbdb92071cc9f92

SHA1
351fdb965b1934ae77ed67b3cd5a88b92cfe8255

SHA256
69e2e2f3a06a003ec0d0ddcae1a3abcab911a584267571786a7aa7a393e54483

SHA512
54216b49353a869ed361ea50bdf2f070b5a22284f758ff9fd90f38825e7c410d9e18ec7380098779b8236d0748d82b42c433fe01ac0e72da56f39ca2543736ad

Download Submit
memory/2412-7-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2412-5-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2456-76-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2456-77-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3000-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3000-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3000-15-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3000-78-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3000-185-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads