cycbot | 31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095

General

Target

31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095N.exe
Size

165KB
MD5

cd0e91bba7713d1a7c66d50c4f9aed90
SHA1

fc4dde2537881ce341b8054fe64a9659a235bfaa
SHA256

31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095
SHA512

2a1eb564056bb3ea26d4ec36ba1c88482ec7fb26b788dbcde7389f654400403519d0d9c82ec544694e668ddbebba0b3a28ca4e70bf0e452764a6b5ada50615a5
SSDEEP

3072:EfkfcHxa/ZrtSBnZ+k2/d7V2g855t1dRTvydaDgA+XtZ4X:akfcHxaRhS7+kId/85zLRxgAiZ4

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2492-14-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/2492-16-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/276-21-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/276-86-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/1224-89-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot
behavioral1/memory/276-208-0x0000000000400000-0x0000000000445000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095N.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/276-2-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2492-14-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2492-13-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2492-16-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/276-21-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/276-86-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1224-88-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/1224-89-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/276-208-0x0000000000400000-0x0000000000445000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095N.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 276 wrote to memory of 2492	276	31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095N.exe	31
PID 276 wrote to memory of 2492	276	31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095N.exe	31
PID 276 wrote to memory of 2492	276	31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095N.exe	31
PID 276 wrote to memory of 2492	276	31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095N.exe	31
PID 276 wrote to memory of 1224	276	31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095N.exe	33
PID 276 wrote to memory of 1224	276	31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095N.exe	33
PID 276 wrote to memory of 1224	276	31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095N.exe	33
PID 276 wrote to memory of 1224	276	31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095N.exe	33

C:\Users\Admin\AppData\Local\Temp\31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095N.exe
"C:\Users\Admin\AppData\Local\Temp\31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095N.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:276
- C:\Users\Admin\AppData\Local\Temp\31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095N.exe
  C:\Users\Admin\AppData\Local\Temp\31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095N.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2492
- C:\Users\Admin\AppData\Local\Temp\31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095N.exe
  C:\Users\Admin\AppData\Local\Temp\31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095N.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\7312.373

Filesize
1KB

MD5
9f11fa0a31f2b534cecc4ea789f2b6ae

SHA1
c08142c4b197cb597bb8ac7bb7bb4c9ad9287ecf

SHA256
1295e21dd961a487f392ae0b23330b02c81d4452febc052c311a1f9dde3cfca3

SHA512
603cf638418ff9558f0e4f2bbd4727f73578347c771cc3913a4a6cf699c0f2d370222eaf8fae77040eebaea7b0c61a4130aab10e5cb670816f031e03c1c6dd8b

Download Submit
C:\Users\Admin\AppData\Roaming\7312.373

Filesize
897B

MD5
234adad9e3b5c0818b4e2ffbbcacb8e2

SHA1
370f398fe5c4517971ba86e353c05bb52304414f

SHA256
1e965e6185904448b528998c74ba0f0349afc9731895674bb2c499f882375acc

SHA512
7ed0d114a17b2b46c2bf900e4b43b0b08df2147c5aa37dbc3acb12f30db4863706cd29d85ce3202ad08d538fbaac39088add57c3779f988fa0e33f53efcd9657

Download Submit
C:\Users\Admin\AppData\Roaming\7312.373

Filesize
1KB

MD5
f391fa5ade3818ac77af4e03a6869edd

SHA1
6c3d874c389f96b155affa55870775c822d0540e

SHA256
b1409e5e8e7cb28ea8755e98231185280cde6f994f0bc54077bc1c0750054b0e

SHA512
e80958ec10f3d14d61b8be06401d0f4e92e2e3248271f337088874d323dc379fa5aab4f059ed9c9545260b3da6fce76a05b25219d4473d9b492868d1079236a3

Download Submit
C:\Users\Admin\AppData\Roaming\7312.373

Filesize
597B

MD5
0cd2f5173f35296d0678a27d252d73f2

SHA1
82a20cbe740c1c744a1f798b706eaea2fe727547

SHA256
e44ac3da01ddcf627d6b2c362556c9c7ae430cf282b15ce483e0e8a1bd83d26f

SHA512
3e1556fa5f8db2c217eb11b375b05a4ab532f0dddee210ce9df275955ae835a0ba98f2425f3a5f4d372e403282bfb077b782a9ff1ce3797e302deb76ad5371b7

Download Submit
memory/276-86-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/276-21-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/276-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/276-2-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/276-208-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1224-88-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1224-89-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2492-16-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2492-13-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2492-14-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads