cycbot | 322269c754b762b5dac7d6f3348edc607d4ebc59399db6f278b0b60b84854f83

General

Target

322269c754b762b5dac7d6f3348edc607d4ebc59399db6f278b0b60b84854f83.exe
Size

185KB
MD5

bcf07821abb35f58f330aa3e4ca1ecfc
SHA1

161ae0ba605d571cb54a4a0b63d9ace87aa1cfc4
SHA256

322269c754b762b5dac7d6f3348edc607d4ebc59399db6f278b0b60b84854f83
SHA512

9f891fdc16916f9843207b53d12b01ecbf3f775bc10f67d6faf8b248330a92a88e04131c96537baa92f445053294f179862dc6f2522110219bf3e4934e2be26e
SSDEEP

3072:nIYDw69F10RfNvMTqenRvDi3OOk0djGzC/o+ZsFeM+VktbMUNR/YdRRe2dH+gCg:Ij6TyMPnRvu3OJCGzCg+Z6eYbMUfWRLp

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/4960-9-0x0000000000400000-0x0000000000471000-memory.dmp	family_cycbot
behavioral2/memory/2584-14-0x0000000000400000-0x0000000000471000-memory.dmp	family_cycbot
behavioral2/memory/4416-82-0x0000000000400000-0x0000000000471000-memory.dmp	family_cycbot
behavioral2/memory/2584-191-0x0000000000400000-0x0000000000471000-memory.dmp	family_cycbot

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2584-2-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral2/memory/4960-8-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral2/memory/4960-9-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral2/memory/2584-14-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral2/memory/4416-81-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral2/memory/4416-82-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral2/memory/2584-191-0x0000000000400000-0x0000000000471000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	322269c754b762b5dac7d6f3348edc607d4ebc59399db6f278b0b60b84854f83.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 4960	2584	322269c754b762b5dac7d6f3348edc607d4ebc59399db6f278b0b60b84854f83.exe	83
PID 2584 wrote to memory of 4960	2584	322269c754b762b5dac7d6f3348edc607d4ebc59399db6f278b0b60b84854f83.exe	83
PID 2584 wrote to memory of 4960	2584	322269c754b762b5dac7d6f3348edc607d4ebc59399db6f278b0b60b84854f83.exe	83
PID 2584 wrote to memory of 4416	2584	322269c754b762b5dac7d6f3348edc607d4ebc59399db6f278b0b60b84854f83.exe	85
PID 2584 wrote to memory of 4416	2584	322269c754b762b5dac7d6f3348edc607d4ebc59399db6f278b0b60b84854f83.exe	85
PID 2584 wrote to memory of 4416	2584	322269c754b762b5dac7d6f3348edc607d4ebc59399db6f278b0b60b84854f83.exe	85

C:\Users\Admin\AppData\Local\Temp\322269c754b762b5dac7d6f3348edc607d4ebc59399db6f278b0b60b84854f83.exe
"C:\Users\Admin\AppData\Local\Temp\322269c754b762b5dac7d6f3348edc607d4ebc59399db6f278b0b60b84854f83.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Users\Admin\AppData\Local\Temp\322269c754b762b5dac7d6f3348edc607d4ebc59399db6f278b0b60b84854f83.exe
  C:\Users\Admin\AppData\Local\Temp\322269c754b762b5dac7d6f3348edc607d4ebc59399db6f278b0b60b84854f83.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  PID:4960
- C:\Users\Admin\AppData\Local\Temp\322269c754b762b5dac7d6f3348edc607d4ebc59399db6f278b0b60b84854f83.exe
  C:\Users\Admin\AppData\Local\Temp\322269c754b762b5dac7d6f3348edc607d4ebc59399db6f278b0b60b84854f83.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  PID:4416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\5A98.8FF

Filesize
600B

MD5
b6d872af104427c49497306806b09ee5

SHA1
124f3a34ec6194b27d025aba2f28d58c6c87536a

SHA256
1d391b1fe2a40f154880a18967d893b2b053632905b0acad2119156fd90a4819

SHA512
6e39a45e1a5479a7c603b1d951ca7af18057e563b54ea158e75d2e8a02fc2b0bce5ba294b863942603bce3d12a492af3e3330106e86e9f0c08a4dc5aadd0fce6

Download Submit
C:\Users\Admin\AppData\Roaming\5A98.8FF

Filesize
1KB

MD5
74603261eacf2f09b14a9a1a5d861105

SHA1
e2fe17d7e78192453199b7c5421ceb84ad8f622e

SHA256
b9a88bbc893e59ca6231edd2e614c9b16f5189a37597634b3daaebdc1749b78d

SHA512
eed252e347c959a73145681f92c7d0fde92257dafbd4d4b15ccb26df7cdca54214144197ebfe7413f11d5e0e89001a1b9aac71a5fc13aeff0d9a47ad9be6851a

Download Submit
C:\Users\Admin\AppData\Roaming\5A98.8FF

Filesize
996B

MD5
4dcf1801cef934cc36e1d8a3b57b7265

SHA1
b301c9de280573d6b22fd0b82a1b560bc04051a3

SHA256
002006b55fc588eec1339ec74abe4e0df7c95ba61250d750d4c3eb36483088e6

SHA512
229a5dd63fc3fb9895b5ff9678c3dd1482c0f98bb1c540914917cb2221e5b4f0000f29d6b800be21064e43af71e010a7f824bae08a6919f61a09c2eb52baae93

Download Submit
memory/2584-1-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2584-2-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2584-14-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2584-191-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4416-80-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4416-81-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4416-82-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4960-8-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4960-9-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download

Analysis

Sharing