cycbot | 4ce4836b18ee9955d77c1ffb5bf95b744a517888e9cdca9c8333611d68d51ce1

General

Target

4ce4836b18ee9955d77c1ffb5bf95b744a517888e9cdca9c8333611d68d51ce1.exe
Size

186KB
MD5

7911b3c2b5597bade8af33b64cbead69
SHA1

ba3b3b48152c7387481d637d76535b1490f97185
SHA256

4ce4836b18ee9955d77c1ffb5bf95b744a517888e9cdca9c8333611d68d51ce1
SHA512

391e0216a05ab95fad3adf936accc8770a2238bfa5363f7f178ec0a55063aa93e5eb2460f5cab2399d8c11e98cd07d3397c79d5912846f2341052ec37468501a
SSDEEP

3072:Jz+yYdb/Rs7U5MKTK3jNpp83Jh31+sJcmPmGXxE6E2pfbS1oB0VZhW:pWts7/KTkjNpwJp1vmGXxg2hwoB0

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/4124-13-0x0000000000400000-0x0000000000453000-memory.dmp	family_cycbot
behavioral2/memory/4068-14-0x0000000000400000-0x0000000000453000-memory.dmp	family_cycbot
behavioral2/memory/3260-74-0x0000000000400000-0x0000000000453000-memory.dmp	family_cycbot
behavioral2/memory/4068-171-0x0000000000400000-0x0000000000453000-memory.dmp	family_cycbot

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4068-2-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/4124-11-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/4124-13-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/4068-14-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/3260-73-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/3260-74-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/4068-171-0x0000000000400000-0x0000000000453000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ce4836b18ee9955d77c1ffb5bf95b744a517888e9cdca9c8333611d68d51ce1.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 4124	4068	4ce4836b18ee9955d77c1ffb5bf95b744a517888e9cdca9c8333611d68d51ce1.exe	82
PID 4068 wrote to memory of 4124	4068	4ce4836b18ee9955d77c1ffb5bf95b744a517888e9cdca9c8333611d68d51ce1.exe	82
PID 4068 wrote to memory of 4124	4068	4ce4836b18ee9955d77c1ffb5bf95b744a517888e9cdca9c8333611d68d51ce1.exe	82
PID 4068 wrote to memory of 3260	4068	4ce4836b18ee9955d77c1ffb5bf95b744a517888e9cdca9c8333611d68d51ce1.exe	83
PID 4068 wrote to memory of 3260	4068	4ce4836b18ee9955d77c1ffb5bf95b744a517888e9cdca9c8333611d68d51ce1.exe	83
PID 4068 wrote to memory of 3260	4068	4ce4836b18ee9955d77c1ffb5bf95b744a517888e9cdca9c8333611d68d51ce1.exe	83

C:\Users\Admin\AppData\Local\Temp\4ce4836b18ee9955d77c1ffb5bf95b744a517888e9cdca9c8333611d68d51ce1.exe
"C:\Users\Admin\AppData\Local\Temp\4ce4836b18ee9955d77c1ffb5bf95b744a517888e9cdca9c8333611d68d51ce1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Users\Admin\AppData\Local\Temp\4ce4836b18ee9955d77c1ffb5bf95b744a517888e9cdca9c8333611d68d51ce1.exe
  C:\Users\Admin\AppData\Local\Temp\4ce4836b18ee9955d77c1ffb5bf95b744a517888e9cdca9c8333611d68d51ce1.exe startC:\Program Files (x86)\Internet Explorer\D3AB\645.exe%C:\Program Files (x86)\Internet Explorer\D3AB
  2⤵
  PID:4124
- C:\Users\Admin\AppData\Local\Temp\4ce4836b18ee9955d77c1ffb5bf95b744a517888e9cdca9c8333611d68d51ce1.exe
  C:\Users\Admin\AppData\Local\Temp\4ce4836b18ee9955d77c1ffb5bf95b744a517888e9cdca9c8333611d68d51ce1.exe startC:\Users\Admin\AppData\Roaming\B0294\F5ED3.exe%C:\Users\Admin\AppData\Roaming\B0294
  2⤵
  PID:3260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\B0294\4A82.029

Filesize
1KB

MD5
e8f426dc34b30ee9c11605286b1fac84

SHA1
30653945649e1942401bbdbdb24cfd3dd626ac3b

SHA256
585c693f016fc261339bb191ef2d961aef441b987dd6f0462ac2875a53e20517

SHA512
3e4486c4bc3a290d9707ff37aea4ec0c472291776a5c286485933d602f8bf6720947b2bbde7ed3102574be7793c33d9989c5317c31e17a14265f7ea376d14b08

Download Submit
C:\Users\Admin\AppData\Roaming\B0294\4A82.029

Filesize
600B

MD5
3eb088b6a46f9a5d79c0014e6ce5d446

SHA1
27ff2dc25b1393d5949127da9b58daddab23b066

SHA256
60713a290a57e9df675d71a0526d1689809f5e1d5f4962435567c5752504899b

SHA512
807712526953d1bb3ea8a0aa2f56b88c69fa68b02d6cf875a791bc5fe4638e98dec271ce7dc9530a305595287315bdc529398b2fea9fca304ce9fd75371275e9

Download Submit
C:\Users\Admin\AppData\Roaming\B0294\4A82.029

Filesize
996B

MD5
d390e785f8231d10bef2a927beca877b

SHA1
63c13025c15cef3dfab9469b06e4cd7dde52841f

SHA256
85fd27dbad5bdc5a60e3fd8761840605b2a63d4fae0ad27eb7d803a3ebf5e94a

SHA512
8dfe32ac39f7b8500ae8b0d34ec3bd9a4e4a503455e4c64cca55cea0963fc389cc65f4b747cf1f24cbcb124ade2a17b9d4fd87354de5ec0264a6ecba347496ce

Download Submit
memory/3260-73-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3260-74-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4068-1-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4068-2-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4068-14-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4068-171-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4124-11-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4124-13-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing