cycbot | badb226b241d5ffa435042a8b72d452d167c3a2b4ac46e4cd10e38e709caf70a

General

Target

92100b734649265df037b8a38f8cbaae_JaffaCakes118.exe
Size

193KB
MD5

92100b734649265df037b8a38f8cbaae
SHA1

a9edb8ac7bf958be459e42a153f58c36783fea84
SHA256

badb226b241d5ffa435042a8b72d452d167c3a2b4ac46e4cd10e38e709caf70a
SHA512

922130a816c4939be8be985bf41ecfb53f070e4a9a0bf5eb578e2b957ab9d14f5b9bc4940523cbd44b73e7d6e2bb846bf6997552430980d86f8cbdea28971d7a
SSDEEP

3072:RkgT1FVV5SDr7+L9DAXqSvbTzD1O0x3Qo9sZBokN08bLXCxqqif9WXdnzxBML18K:Ggp1Kz/xgokBljVJ0nHMBnoQA0

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2016-7-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot
behavioral1/memory/2308-14-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot
behavioral1/memory/1776-84-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot
behavioral1/memory/2308-152-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot
behavioral1/memory/2308-186-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2308-2-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2016-5-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2016-7-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2308-14-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/1776-82-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/1776-84-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2308-152-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2308-186-0x0000000000400000-0x0000000000447000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	92100b734649265df037b8a38f8cbaae_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	92100b734649265df037b8a38f8cbaae_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	92100b734649265df037b8a38f8cbaae_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2016	2308	92100b734649265df037b8a38f8cbaae_JaffaCakes118.exe	31
PID 2308 wrote to memory of 2016	2308	92100b734649265df037b8a38f8cbaae_JaffaCakes118.exe	31
PID 2308 wrote to memory of 2016	2308	92100b734649265df037b8a38f8cbaae_JaffaCakes118.exe	31
PID 2308 wrote to memory of 2016	2308	92100b734649265df037b8a38f8cbaae_JaffaCakes118.exe	31
PID 2308 wrote to memory of 1776	2308	92100b734649265df037b8a38f8cbaae_JaffaCakes118.exe	33
PID 2308 wrote to memory of 1776	2308	92100b734649265df037b8a38f8cbaae_JaffaCakes118.exe	33
PID 2308 wrote to memory of 1776	2308	92100b734649265df037b8a38f8cbaae_JaffaCakes118.exe	33
PID 2308 wrote to memory of 1776	2308	92100b734649265df037b8a38f8cbaae_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\92100b734649265df037b8a38f8cbaae_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\92100b734649265df037b8a38f8cbaae_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Users\Admin\AppData\Local\Temp\92100b734649265df037b8a38f8cbaae_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\92100b734649265df037b8a38f8cbaae_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2016
- C:\Users\Admin\AppData\Local\Temp\92100b734649265df037b8a38f8cbaae_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\92100b734649265df037b8a38f8cbaae_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\029C.64F

Filesize
1KB

MD5
d6d0e2ca586995f76b5794ed3f8d7702

SHA1
5c246d63c15fc1ffcbf2aa2e4989477823c84394

SHA256
944d2073f4e2d62b71af09a7b17625cf752d86595e46db9d98f921bd2d1f474d

SHA512
99d4864eab2b1cf063c1af2ed5da9924153aad91d5f68d9ed2fe602e12fcd1fd13e40aef569872604968c4aa5b792dc37f1ef653d1ed15f1869737d09be566c3

Download Submit
C:\Users\Admin\AppData\Roaming\029C.64F

Filesize
600B

MD5
8ddbca1305358f26ca9aefcca03e373f

SHA1
6d923598a0880bf39a45f6f12120e267bf892d92

SHA256
96a582d6c4176b07f330dd303b3a524f1b61b66c0e50a9eb0cc0a82ffc704d78

SHA512
488b1f406023bf7e740d72e824b8297cb18a920572ac2d636c7d9e0e31593c33dd67fd6dc840174d149c05cc71369cf211fd8286135d650eaa1629560c8ba834

Download Submit
C:\Users\Admin\AppData\Roaming\029C.64F

Filesize
996B

MD5
287e520a28812cde2e2c66bc8174e21d

SHA1
e23b5fd816bc604320f8959e82281dea6d690842

SHA256
ec0f777681411221b063df1f39026215b788899ec780898db4411c5a21aef541

SHA512
e78ee53faa6493abf92e14fc41eeaefc3ed88b3e036e3f4c9b0d177081dfc982d0e10175ddd32c04ae3c53985d7ed11c9a05ab3c37685003ae8725a4c0db777d

Download Submit
memory/1776-82-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1776-84-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2016-5-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2016-7-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2308-1-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2308-2-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2308-14-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2308-152-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2308-186-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing