cycbot | 46ef3c8300d94ee30477e91af51292b707075bcc55a2d30a47338422c2f88bb8

General

Target

46ef3c8300d94ee30477e91af51292b707075bcc55a2d30a47338422c2f88bb8.exe
Size

193KB
MD5

ec968ef4f284d6f78f7febbf47a53e55
SHA1

150212737147274f9da79644a781f1d7b2dac843
SHA256

46ef3c8300d94ee30477e91af51292b707075bcc55a2d30a47338422c2f88bb8
SHA512

9bc8090120a503d43d0811642596cf70cee1fcbaaf536feb033000dc009a09d056df77a2bfbcae3113d2546987867c8007a73cfdf88ffb10fac0c9395ea0854c
SSDEEP

3072:pdw8KI2FAwZXhgEYHTWglAGib6nYNw56Fdw0wAIFhgJTZO9/6OCTMFkp35:pd5hMWNHrlabBw5OwA49ijTGe5

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2712-12-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2712-14-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2708-15-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2432-67-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2708-185-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2708-2-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2712-12-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2712-14-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2708-15-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2432-66-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2432-67-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2708-185-0x0000000000400000-0x000000000044E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46ef3c8300d94ee30477e91af51292b707075bcc55a2d30a47338422c2f88bb8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46ef3c8300d94ee30477e91af51292b707075bcc55a2d30a47338422c2f88bb8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46ef3c8300d94ee30477e91af51292b707075bcc55a2d30a47338422c2f88bb8.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2712	2708	46ef3c8300d94ee30477e91af51292b707075bcc55a2d30a47338422c2f88bb8.exe	31
PID 2708 wrote to memory of 2712	2708	46ef3c8300d94ee30477e91af51292b707075bcc55a2d30a47338422c2f88bb8.exe	31
PID 2708 wrote to memory of 2712	2708	46ef3c8300d94ee30477e91af51292b707075bcc55a2d30a47338422c2f88bb8.exe	31
PID 2708 wrote to memory of 2712	2708	46ef3c8300d94ee30477e91af51292b707075bcc55a2d30a47338422c2f88bb8.exe	31
PID 2708 wrote to memory of 2432	2708	46ef3c8300d94ee30477e91af51292b707075bcc55a2d30a47338422c2f88bb8.exe	33
PID 2708 wrote to memory of 2432	2708	46ef3c8300d94ee30477e91af51292b707075bcc55a2d30a47338422c2f88bb8.exe	33
PID 2708 wrote to memory of 2432	2708	46ef3c8300d94ee30477e91af51292b707075bcc55a2d30a47338422c2f88bb8.exe	33
PID 2708 wrote to memory of 2432	2708	46ef3c8300d94ee30477e91af51292b707075bcc55a2d30a47338422c2f88bb8.exe	33

C:\Users\Admin\AppData\Local\Temp\46ef3c8300d94ee30477e91af51292b707075bcc55a2d30a47338422c2f88bb8.exe
"C:\Users\Admin\AppData\Local\Temp\46ef3c8300d94ee30477e91af51292b707075bcc55a2d30a47338422c2f88bb8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Users\Admin\AppData\Local\Temp\46ef3c8300d94ee30477e91af51292b707075bcc55a2d30a47338422c2f88bb8.exe
  C:\Users\Admin\AppData\Local\Temp\46ef3c8300d94ee30477e91af51292b707075bcc55a2d30a47338422c2f88bb8.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2712
- C:\Users\Admin\AppData\Local\Temp\46ef3c8300d94ee30477e91af51292b707075bcc55a2d30a47338422c2f88bb8.exe
  C:\Users\Admin\AppData\Local\Temp\46ef3c8300d94ee30477e91af51292b707075bcc55a2d30a47338422c2f88bb8.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\9847.51A

Filesize
1KB

MD5
463c37d40b911cccd0fdf417bd545988

SHA1
60660b8e99dfd30755e96475d33aff8e6841d050

SHA256
688b145c536f9683f3dcaa182eaed24e35f643e210f19c6508005365516dca50

SHA512
9f5a7ac660f103577e72f15da9422d55c168a3684909047e8e04559ca710132c6a3389d7fc24a89c42152646d29c77467f3089b2107720e9e1c90f9fe9165a73

Download Submit
C:\Users\Admin\AppData\Roaming\9847.51A

Filesize
1KB

MD5
09816bb31eb675c51db3dce35bbba948

SHA1
6e3f1f71fd08613089a3d8a8d31e8dab455a8982

SHA256
1bb6ddd8b44410c4abefddb2811ef2b0c804a6b7f59c7bc0ecea30d098f7862b

SHA512
3285298c5e7626ee6297e47c17b30b6b4d23bec5876c22cdf35befa560e6588d197490357ee4446413d2342bc08ca3680dd1e480ecf5bdace43f876f7e499436

Download Submit
C:\Users\Admin\AppData\Roaming\9847.51A

Filesize
600B

MD5
9e9e5e71508346bca9cef669b2382949

SHA1
1ab628f0d13db297832bc61380a685d8c0c9e89b

SHA256
eaa009af161758221b347984102c10e88a9d60b5cc73b6cfcf941f66ca1c8f53

SHA512
90332bea27b457dc5eedcd17726ac423f847903a7ba1a69379d84acaaf9ca48f69eb7071de909283ff69677a86de51f26c9ccfc5e79684bceca59f16fcc17a16

Download Submit
C:\Users\Admin\AppData\Roaming\9847.51A

Filesize
996B

MD5
f052821711ed7450c5da51a7242019e7

SHA1
e5b0df69ca93cbc45cf082133293d10e5f9cf7c8

SHA256
108098bcba3c1ad161165f6071c55a9b6707aa8c4fc17d6635ab1e3156525e5c

SHA512
d5686158991002b103790b7066bc7281eea913a9ee388fc04424559e338298b070f144eb30220f0189a263e86f32f9bfd02bebb5353de59a152403c1e55a2361

Download Submit
memory/2432-66-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2432-67-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2708-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2708-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2708-15-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2708-185-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2712-12-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2712-14-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing