cycbot | 02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55

General

Target

02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55.exe
Size

194KB
MD5

f63d833c10db768188e7d27c6440f021
SHA1

3dd44f62b6851518eb44008810f31f41efd715f6
SHA256

02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55
SHA512

e1d72af631620fd583146df64fce5b0df0bd8dbc39a498a29c669e210a902dd5cc5f47454142609845ef595dff5adeba85aff7b1d59fd3c3929e1ca9961fe585
SSDEEP

3072:5aIAIURcG02hGZ3yMAx4AvS/1JjU+hGGhVTOEPttEvuMu8asuiUh/b49neFiFaoB:5mTRx0z3yMQDS/XjzYi/lkBN7JCDZ4t

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2792-8-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1088-16-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2028-71-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1088-184-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process
PID 1088 set thread context of 0	1088	02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55.exe
PID 2792 set thread context of 0	2792	02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55.exe
PID 2028 set thread context of 0	2028	02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1088-2-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2792-6-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2792-8-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1088-16-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2028-69-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2028-71-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1088-184-0x0000000000400000-0x000000000046A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 2792	1088	02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55.exe	30
PID 1088 wrote to memory of 2792	1088	02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55.exe	30
PID 1088 wrote to memory of 2792	1088	02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55.exe	30
PID 1088 wrote to memory of 2792	1088	02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55.exe	30
PID 1088 wrote to memory of 2028	1088	02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55.exe	32
PID 1088 wrote to memory of 2028	1088	02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55.exe	32
PID 1088 wrote to memory of 2028	1088	02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55.exe	32
PID 1088 wrote to memory of 2028	1088	02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55.exe	32

C:\Users\Admin\AppData\Local\Temp\02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55.exe
"C:\Users\Admin\AppData\Local\Temp\02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Local\Temp\02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55.exe
  C:\Users\Admin\AppData\Local\Temp\02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:2792
- C:\Users\Admin\AppData\Local\Temp\02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55.exe
  C:\Users\Admin\AppData\Local\Temp\02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\631F.821

Filesize
300B

MD5
e413e8ae584954d9e4651bdfeb409a89

SHA1
689e60580cef183718616e840b8094aee7cbb0d9

SHA256
7e1d4341bca19d2095d78a2876fe6adc4177ac2ec483ab874a7097dcf3692c99

SHA512
213faef95ba8a0c26ed54e73c3f2fd55ada878620a4861bcc92ad4dfa77875ab64e6117f87ed8d6d1e4eab7bb9fec6f4eb26a78a69c1ada2f0c520b299f62ba8

Download Submit
C:\Users\Admin\AppData\Roaming\631F.821

Filesize
1KB

MD5
d42ab1852cac1bff23d6bd4f8455b695

SHA1
05e5e239dadb6006d666a1dbb446d131fa984a41

SHA256
20da4ccc2efaad86491e28ee89a957ec40f22ea474ecc726d275b1319aae8ce5

SHA512
208462773c493e4b89ed8f58fe5efa5941290205efa16b867e8260931449ec758dfc01fc28b9b0538fbe3bad8c146c326b7ec8084bed13b0a0158a7b960e1341

Download Submit
C:\Users\Admin\AppData\Roaming\631F.821

Filesize
600B

MD5
7bf6864275e7726ce9fc6d887d9758b2

SHA1
207afeacb38a179dc70ed41d4db39c7003be403f

SHA256
6098baa319d4568695a8959f43d4806e468397747dcf5de45c83d83d4a78593e

SHA512
9ffeca8d6bd2f9782168842fab6cbae743e1c3a5d34d11b8532bdc3322a9277a7d2a5996d76bf90746c0e0b9a878f80570637a9f88e27aa030393221f8cfd981

Download Submit
C:\Users\Admin\AppData\Roaming\631F.821

Filesize
996B

MD5
71cbe36d16efdc7c5d29d2c843bb8f96

SHA1
bd0f4f22de81529bc909acec6e40e8ce56a95ba7

SHA256
bf8a94d61f154af61941154851dfe2f0deb301dd4462c8cd7274515977cdf244

SHA512
7f81c501a11ae775b00da6ab02258b85a9abbce30d027a806909c42af4e8ea6bacb78322f6cb68b7b31250b935813e187a22d8348aaba36adcc872b6ca4b77c1

Download Submit
memory/1088-1-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1088-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1088-184-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1088-16-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2028-71-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2028-69-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2792-5-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2792-8-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2792-6-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing