Overview

overview

10

Static

static

3

58394780bc...0f.exe

windows7-x64

10

58394780bc...0f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02-01-2025 23:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    58394780bce1d12eac6ec3ce573d8bd092a2112680e0e6a6f8e2eec0f88f080f.exe

  • Size

    655KB

  • MD5

    4775d3d32c39718c595007a3a2b110cf

  • SHA1

    dcfcc25a8ab8fe67abee4f368dbfc3c6e4a7fb07

  • SHA256

    58394780bce1d12eac6ec3ce573d8bd092a2112680e0e6a6f8e2eec0f88f080f

  • SHA512

    363e6adbc8a842e4f1292f419301f7974b693c3078072bce235a31b5ad72c1aa1f93a5e4db92841d380fb5ffb69942b165f26e8b674a817ccd35b1566e0b69e0

  • SSDEEP

    12288:/ESqJwbBEE+tOiAc2xwlqXs4zUmvycM6xgNyJ6DsZuhEP60dIIFazZyun23:/EdYj+jAc21lz/VnxgAJxuOCciZzE

Score
10/10
cycbotponybackdoorcredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 3 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 14 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 53 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\58394780bce1d12eac6ec3ce573d8bd092a2112680e0e6a6f8e2eec0f88f080f.exe
    "C:\Users\Admin\AppData\Local\Temp\58394780bce1d12eac6ec3ce573d8bd092a2112680e0e6a6f8e2eec0f88f080f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2900
    • C:\Users\Admin\AppData\Local\Temp\58394780bce1d12eac6ec3ce573d8bd092a2112680e0e6a6f8e2eec0f88f080f.exe
      58394780bce1d12eac6ec3ce573d8bd092a2112680e0e6a6f8e2eec0f88f080f.exe
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2000
      • C:\Users\Admin\R07924.exe
        C:\Users\Admin\R07924.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1664
        • C:\Users\Admin\tmdoej.exe
          "C:\Users\Admin\tmdoej.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:1672
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del R07924.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2952
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2624
      • C:\Users\Admin\aehost.exe
        C:\Users\Admin\aehost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2640
        • C:\Users\Admin\aehost.exe
          aehost.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2744
      • C:\Users\Admin\behost.exe
        C:\Users\Admin\behost.exe
        3⤵
        • Modifies security service
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2528
        • C:\Users\Admin\behost.exe
          C:\Users\Admin\behost.exe startC:\Users\Admin\AppData\Roaming\3DA4E\78ED3.exe%C:\Users\Admin\AppData\Roaming\3DA4E
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:480
        • C:\Users\Admin\behost.exe
          C:\Users\Admin\behost.exe startC:\Program Files (x86)\4E127\lvvm.exe%C:\Program Files (x86)\4E127
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2664
        • C:\Program Files (x86)\LP\D3A3\51A9.tmp
          "C:\Program Files (x86)\LP\D3A3\51A9.tmp"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:316
      • C:\Users\Admin\cehost.exe
        C:\Users\Admin\cehost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2308
        • C:\Windows\explorer.exe
          000000C0*
          4⤵
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2724
      • C:\Users\Admin\dehost.exe
        C:\Users\Admin\dehost.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:832
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del 58394780bce1d12eac6ec3ce573d8bd092a2112680e0e6a6f8e2eec0f88f080f.exe
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:2144
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2932
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1908
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Modify Registry

5
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Process Discovery

1
T1057

Query Registry

2
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\3DA4E\E127.DA4
    Filesize

    600B

    MD5

    afca16772de6ba94ebae26d189f68bd4

    SHA1

    7344d2b0bde7dd75e710643812ca6e36c3cfcd18

    SHA256

    9f57d091e9de490df8012a799d2c82ede2c146f6b75b54c00f1ac28531e32ac6

    SHA512

    eb283b78663cb2fafd81adb05d2707453c5970f2a8408f7718eb389b0521103964436962518a6804bca4f790de24c3327f1158551567d8b4f1587d6618c25947

    Download Submit

  • C:\Users\Admin\AppData\Roaming\3DA4E\E127.DA4
    Filesize

    996B

    MD5

    1ed13f508338d28f4a7c0df74cf807a8

    SHA1

    edd8511eb49d377994f51d00de5e8ae8627f8547

    SHA256

    aa580d04847edd1a25b1a370037dcd348c53b73e5f135eabe939d6e8cb086eed

    SHA512

    627fb666c89fae5664405172416ac03c7cda2d4c06f39b1453be898ff5314aefb298075f68fad72baf66b0b6ccc63699444ae0fd60c4f3af948d071cf207ed2b

    Download Submit

  • C:\Users\Admin\AppData\Roaming\3DA4E\E127.DA4
    Filesize

    1KB

    MD5

    a72c5c164c0d1467424708a9950d0d3b

    SHA1

    8e6983923401bff1478ae1dd770ba68ba678de36

    SHA256

    e4a6bedd8bb53060369a07da840997acae738e40d6dc8171fcd977feb6bbfcf9

    SHA512

    4c6490d88b77565feefc83ddcdd7fffd5a73cea9ffee7aa3dd7787302e28077faee7108857bc3f75052f87cdbf35adb6b17321cf3b348004b7d30a1995e7269d

    Download Submit

  • C:\Users\Admin\AppData\Roaming\3DA4E\E127.DA4
    Filesize

    1KB

    MD5

    85bcf5f54f937fa041c1d81f34798680

    SHA1

    0e9f79ce1a9662711e053525fa5c9cecec9aafa6

    SHA256

    46f84efc4c801b21e61395743858b3c5ab16c77513da0afcd9ecaa435f6f002f

    SHA512

    5caaac1bb8c33d8061bf241ad2210241f41c6b357d3113a251f5b92bc8b13533fd0b2ec7f3ba5de4963072529135c3cadce5e64f684e0c4d86ba1aa46032c8f0

    Download Submit

  • \Program Files (x86)\LP\D3A3\51A9.tmp
    Filesize

    104KB

    MD5

    0cb09d0443d2eda312058ae1a2fa83c2

    SHA1

    1888844fcab4269a5c08b5cf122b100e8abb3cb0

    SHA256

    50a9af2fe05dd06d6ff825bcf2106b64385e7fdf9a06a0a18ac187c4a057503a

    SHA512

    93bfdc4d14a7ba7cce25d0a83faa29e0efa7932f3024aa82fcc1d606cb9a65e0ebd91942ad9992ce787f639df1748fde9599cb9b676245a17a8198064df2e24c

    Download Submit

  • \Users\Admin\R07924.exe
    Filesize

    188KB

    MD5

    4f9c5823c5d1255ded151b01c0a58e15

    SHA1

    2f7018a9211472ddfa5d2f09629bf90adce4676c

    SHA256

    e38564871dc5952e2d1d22d51e312e3064cf84df95c0420021153cb5c264adcf

    SHA512

    b5518effbf476d9486a5ddaa65c937e97b10470d533f8e0c9af30956868c032f6bdb524d13a004e4a0d19e9a88b5f3f11ee82e5602b1175092fb36a9959d40ca

    Download Submit

  • \Users\Admin\aehost.exe
    Filesize

    129KB

    MD5

    e2b1704acdf48221cd9be91bae3546c5

    SHA1

    f53a59b62276f58cf8689768f747e16f53dbd341

    SHA256

    8b1c13bb2e95f71ed75d8fca7aeefc556ecd377d5d4f6c544d77ac8f74255ca5

    SHA512

    1b3d8baa981851a79c4f12f3ea2a4d197b3439e76ca723acd578acabd731310d6eeb3a4567a10d48f45192ae9c4cd732eca04c0a7fffa636e7bd364ed1357b53

    Download Submit

  • \Users\Admin\behost.exe
    Filesize

    279KB

    MD5

    2a583120a51178ee5f8bc2727faaa73e

    SHA1

    91296d42eeddb285aeea28f5139cadda10f21df7

    SHA256

    b315e97fff3561563da4dcf7283636f42eef9ebaf422506e01f03716d4877b02

    SHA512

    003e11b916256091486311881a06286d532a9940d75977a44afa3c116277a0f490505e9b4053f56846fb6d1d7584d7748f622bc9cae088af93820452027dac8b

    Download Submit

  • \Users\Admin\cehost.exe
    Filesize

    145KB

    MD5

    56be9270582de0986c72139ea218e121

    SHA1

    d33b8a2127ccf6b6f42a0c0f266136a376def18c

    SHA256

    8b40a882fde5ef3df2ec3112142b654c949adf7f559bc1912ad9d08ebb17c257

    SHA512

    dcee7d3d16e19e5a36a386d097c171ed7761ad4fc626b5d523b9c33f952fa24da733c56fcb8ff440894c3672c468d04cecc001ae9a680a9607347a5f517e6023

    Download Submit

  • \Users\Admin\dehost.exe
    Filesize

    24KB

    MD5

    7cda5863b933988b7bd1d0c8035dafd9

    SHA1

    68c64d655d0df1c9974587d12b3b88f5ce1f4cac

    SHA256

    400cb530f1489c46ada1dedc35b51cb53e8174f5cdda0d086ef593c135e0f216

    SHA512

    978440c09b70b695fdc171c6e2a7c064aa078d4a300db7f297afde5e3c1cfdf513da01dae967a9a8c524c185432ef87bf922a5cc97a9c8a6d1fd9cc3155e0aea

    Download Submit

  • \Users\Admin\tmdoej.exe
    Filesize

    188KB

    MD5

    acfa703a6fc35d23527460d112ca15e2

    SHA1

    8d0b3613461c98c7ddb1ca0dfe64a0104324d789

    SHA256

    570154460625cbb7c7760ca330dc58e0409ddffe6e5fafea562279500a42b0eb

    SHA512

    86ae2d693bc40fdc1f1106bccd79ddfe2360a6a4aa378f8db800798c8354755295febe9abb7c729060c166900cbaa11cfb7d83cf2bb530253bfd49ef4ef8300c

    Download Submit

  • memory/480-137-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/1664-45-0x0000000003A30000-0x00000000044EA000-memory.dmp

    Filesize

    10.7MB

    Download

  • memory/2000-2-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

    Download

  • memory/2000-14-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

    Download

  • memory/2000-89-0x00000000002B0000-0x00000000002F2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2000-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2000-0-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

    Download

  • memory/2000-6-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

    Download

  • memory/2000-4-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

    Download

  • memory/2000-53-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

    Download

  • memory/2000-345-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

    Download

  • memory/2000-13-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

    Download

  • memory/2000-16-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

    Download

  • memory/2308-96-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2308-101-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2528-140-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/2640-75-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

    Download

  • memory/2664-216-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

    Download

  • memory/2724-102-0x0000000001F00000-0x0000000001F19000-memory.dmp

    Filesize

    100KB

    Download

  • memory/2724-98-0x00000000000E0000-0x00000000000F5000-memory.dmp

    Filesize

    84KB

    Download

  • memory/2724-112-0x0000000001F00000-0x0000000001F19000-memory.dmp

    Filesize

    100KB

    Download

  • memory/2724-107-0x0000000001F00000-0x0000000001F19000-memory.dmp

    Filesize

    100KB

    Download

  • memory/2744-78-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2744-77-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2744-58-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2744-60-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2744-63-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2744-66-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2744-68-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2744-71-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2744-56-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2900-11-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

    Download