cycbot | 4bfeff9bba0c096697641a0bef4e3dfd808b37cf48ec5954ddc9aeaea835e140

General

Target

VirusShare_0103567aa562f419b8f7f710a18454bf.exe
Size

182KB
MD5

0103567aa562f419b8f7f710a18454bf
SHA1

0e92b28d62700fedf89d9d809b41be33cedaed64
SHA256

4bfeff9bba0c096697641a0bef4e3dfd808b37cf48ec5954ddc9aeaea835e140
SHA512

8c2c6219b6ff2f756a0a4e2360cc1e5963000389f6b237a0c15121f46daeba1530d4af68f2ae1beaf466e2bf843734895f04bc65df510d2f80d22e115ebbb49a
SSDEEP

3072:mUhoj8I2cE/yB4wt1Kmq3h1QyYhR6UJ4XW8HZxTdDEzoKfdWqnZFhqN4Otgm34:mUqgI2cE/yf3gwyYhR6UJ4m8HRPEdWqY

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1692-15-0x0000000000400000-0x000000000048C000-memory.dmp	family_cycbot
behavioral1/memory/2960-16-0x0000000000400000-0x000000000048C000-memory.dmp	family_cycbot
behavioral1/memory/2960-83-0x0000000000400000-0x000000000048C000-memory.dmp	family_cycbot
behavioral1/memory/668-86-0x0000000000400000-0x000000000048C000-memory.dmp	family_cycbot
behavioral1/memory/2960-202-0x0000000000400000-0x000000000048C000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	VirusShare_0103567aa562f419b8f7f710a18454bf.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2960-2-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/1692-14-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/1692-15-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/1692-12-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2960-16-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2960-83-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/668-86-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2960-202-0x0000000000400000-0x000000000048C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VirusShare_0103567aa562f419b8f7f710a18454bf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VirusShare_0103567aa562f419b8f7f710a18454bf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VirusShare_0103567aa562f419b8f7f710a18454bf.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 1692	2960	VirusShare_0103567aa562f419b8f7f710a18454bf.exe	30
PID 2960 wrote to memory of 1692	2960	VirusShare_0103567aa562f419b8f7f710a18454bf.exe	30
PID 2960 wrote to memory of 1692	2960	VirusShare_0103567aa562f419b8f7f710a18454bf.exe	30
PID 2960 wrote to memory of 1692	2960	VirusShare_0103567aa562f419b8f7f710a18454bf.exe	30
PID 2960 wrote to memory of 668	2960	VirusShare_0103567aa562f419b8f7f710a18454bf.exe	33
PID 2960 wrote to memory of 668	2960	VirusShare_0103567aa562f419b8f7f710a18454bf.exe	33
PID 2960 wrote to memory of 668	2960	VirusShare_0103567aa562f419b8f7f710a18454bf.exe	33
PID 2960 wrote to memory of 668	2960	VirusShare_0103567aa562f419b8f7f710a18454bf.exe	33

C:\Users\Admin\AppData\Local\Temp\VirusShare_0103567aa562f419b8f7f710a18454bf.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_0103567aa562f419b8f7f710a18454bf.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Temp\VirusShare_0103567aa562f419b8f7f710a18454bf.exe
  C:\Users\Admin\AppData\Local\Temp\VirusShare_0103567aa562f419b8f7f710a18454bf.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1692
- C:\Users\Admin\AppData\Local\Temp\VirusShare_0103567aa562f419b8f7f710a18454bf.exe
  C:\Users\Admin\AppData\Local\Temp\VirusShare_0103567aa562f419b8f7f710a18454bf.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\8DDF.557

Filesize
1KB

MD5
382650d31d0e260a0c47a9e0a7f57ddc

SHA1
d14e9fbabbfa5dad7c2fa7030517ed8a9302e5f3

SHA256
a5e8a65e81253803b1ed9ef21fb6f2595d2051ebad257a9e0697dfc62080745b

SHA512
ca51dcaeddfadaa1498d2b738deb168f3ecab482f30b40d1cc93f125685bdd88c27a583259a03261be6036f3ed9b9f0cbe3e23fb0f42f7174f49b36364f2898b

Download Submit
C:\Users\Admin\AppData\Roaming\8DDF.557

Filesize
600B

MD5
ec60f995de52c4e2b69d83381cb8fa74

SHA1
c513e7c1d2d675b7581650d58045a185bf5554be

SHA256
17b19ac4c2e0c03bb28e74d7b4eaea9fa3f0bca9aa102fe5af7ad14ebab991a8

SHA512
963907bc77337680f88c64f4b994663484a171e4517c564369ccee1e4174796c6f2d026292112142d8a4c784887afde8b191c9546965ed75264e7193fb06f144

Download Submit
C:\Users\Admin\AppData\Roaming\8DDF.557

Filesize
996B

MD5
f355964b5b92bb6b3ec36968ef6bfa72

SHA1
46df13bdb68140363352816e31671625d715810e

SHA256
d418ddc71136cb17120d81bca7be878a9ac2719cecd30af27527766b1341b7f6

SHA512
7b8663a161a5ac4da16ac68d166026b908311de51bb862e05d9f025aed13af20af0fc44fcca160c1a13b1088cae527da894500c928273ebf210db525419acfd4

Download Submit
memory/668-86-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/668-87-0x000000000067D000-0x0000000000698000-memory.dmp

Filesize
108KB

Download
memory/1692-12-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1692-15-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1692-14-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2960-16-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2960-83-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2960-1-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2960-2-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2960-202-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads