cycbot | 7661b810e344780bb7c399c227079c91d2b9a50c5d9a4c251684edd22f8204f4

General

Target

921d3755390ed829d38070cb2cb2083e_JaffaCakes118.exe
Size

181KB
MD5

921d3755390ed829d38070cb2cb2083e
SHA1

28a81d4a4a56514c2e80e8272af06144e0d61d19
SHA256

7661b810e344780bb7c399c227079c91d2b9a50c5d9a4c251684edd22f8204f4
SHA512

c6c042335d5292db468a9d3e1dd65ed91ed3cc73d40dfb087254d9375181719e8c00ec050deac897b7f73029c4ae8ad3004ddc056b3a0ef26a0a24c06cd20cd5
SSDEEP

3072:1hjdtzjWVywdP6OjuYxxPUiHvTiT8zVUkfIGFmSc9L2t5KQjOdhyy:1VOHpxc+2TWCkXFmRu5Ke29

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

Processes:

resource	yara_rule
behavioral2/memory/2420-13-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral2/memory/68-14-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral2/memory/4256-85-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral2/memory/68-192-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/68-2-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/2420-12-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/2420-13-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/68-14-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/4256-84-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/4256-83-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/4256-85-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/68-192-0x0000000000400000-0x000000000044E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

921d3755390ed829d38070cb2cb2083e_JaffaCakes118.exe921d3755390ed829d38070cb2cb2083e_JaffaCakes118.exe921d3755390ed829d38070cb2cb2083e_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	921d3755390ed829d38070cb2cb2083e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	921d3755390ed829d38070cb2cb2083e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	921d3755390ed829d38070cb2cb2083e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

921d3755390ed829d38070cb2cb2083e_JaffaCakes118.exe

description	pid	Process	procid_target
PID 68 wrote to memory of 2420	68	921d3755390ed829d38070cb2cb2083e_JaffaCakes118.exe	83
PID 68 wrote to memory of 2420	68	921d3755390ed829d38070cb2cb2083e_JaffaCakes118.exe	83
PID 68 wrote to memory of 2420	68	921d3755390ed829d38070cb2cb2083e_JaffaCakes118.exe	83
PID 68 wrote to memory of 4256	68	921d3755390ed829d38070cb2cb2083e_JaffaCakes118.exe	96
PID 68 wrote to memory of 4256	68	921d3755390ed829d38070cb2cb2083e_JaffaCakes118.exe	96
PID 68 wrote to memory of 4256	68	921d3755390ed829d38070cb2cb2083e_JaffaCakes118.exe	96

C:\Users\Admin\AppData\Local\Temp\921d3755390ed829d38070cb2cb2083e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\921d3755390ed829d38070cb2cb2083e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:68
- C:\Users\Admin\AppData\Local\Temp\921d3755390ed829d38070cb2cb2083e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\921d3755390ed829d38070cb2cb2083e_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2420
- C:\Users\Admin\AppData\Local\Temp\921d3755390ed829d38070cb2cb2083e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\921d3755390ed829d38070cb2cb2083e_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\829E.16A

Filesize
1KB

MD5
d38d38cc6bb3328dcf081f811995f2fb

SHA1
28af112b16df33d01266174cadb5f6ea766718f6

SHA256
6fc70501d5af78ab94189da4d89b88b3a8a8a55686a1463db023afbd2d3dbbf0

SHA512
3b85a8655c21eb264d99452e0ba09a999ff8f6bc801bcb4e21a0bdd6937ec67931497c4ec572e2cd71b261fc4fe1b8145fc02587bc5371932db08b23b82ff4d5

Download Submit
C:\Users\Admin\AppData\Roaming\829E.16A

Filesize
600B

MD5
2e13e198011ecb3b3c8664e890eac539

SHA1
e2bc2fcaf6a2d14d0c9ac036277e3269b270d689

SHA256
3c65ef6dd5196249db6b35a341aae3cb8fb18ac0a7c2a0165e2ce95f86b41f01

SHA512
9da667ae5c37cae532715d3ac1eddbf78b9426e66c7455b449337fb134423b4146c65c7e0fa3e5e8f8c2b347892ed7aa63adb553cbb939fec437e4285a6ce5e6

Download Submit
C:\Users\Admin\AppData\Roaming\829E.16A

Filesize
996B

MD5
ef90fb598e06fff620f195d238a613aa

SHA1
710625b60fb58d359d574d120b5d3c2eb061204d

SHA256
6c97908889951510e1f1ac18784d6df2beb1acb8f99aba8d33784735895c2e67

SHA512
a20e647435f7d1e5059d2ba14337658dc2a344750cae3712ab0d59900ea57249e52a2cc844b959f86f647f360af076edfe02e6791d04cafd500dcf462a425748

Download Submit
memory/68-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/68-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/68-14-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/68-192-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2420-12-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2420-13-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4256-84-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4256-83-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4256-85-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads