cycbot | ba0743da334c2d36628fe8ae063e91cb8fe90784cb9b98231b9662cff14b8d8a

General

Target

93ba341615ec9cad286cffa7d5b8e79e_JaffaCakes118.exe
Size

173KB
MD5

93ba341615ec9cad286cffa7d5b8e79e
SHA1

27326fe14aead048b7741881c8a33470e693cc99
SHA256

ba0743da334c2d36628fe8ae063e91cb8fe90784cb9b98231b9662cff14b8d8a
SHA512

a7e8104b07247684cec304860a1c5c2f1c2c4f9d543e895062fa388bb69f4a1cdd66a2fe52907b34dc85f00de951b23a622ec02352808194ae536e24d26979b6
SSDEEP

3072:0jyHOlTD5plj9XJQe3WfraiKW0Ccqw8aRv686dei7SmF0t92d:COe9LjFJJWf2iz9wLVfgeiGmF0

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2204-7-0x0000000000400000-0x0000000000463000-memory.dmp	family_cycbot
behavioral1/memory/1548-14-0x0000000000400000-0x0000000000463000-memory.dmp	family_cycbot
behavioral1/memory/2936-79-0x0000000000400000-0x0000000000463000-memory.dmp	family_cycbot
behavioral1/memory/1548-167-0x0000000000400000-0x0000000000463000-memory.dmp	family_cycbot
behavioral1/memory/1548-204-0x0000000000400000-0x0000000000463000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1548-2-0x0000000000400000-0x0000000000463000-memory.dmp	upx
behavioral1/memory/2204-5-0x0000000000400000-0x0000000000463000-memory.dmp	upx
behavioral1/memory/2204-7-0x0000000000400000-0x0000000000463000-memory.dmp	upx
behavioral1/memory/1548-14-0x0000000000400000-0x0000000000463000-memory.dmp	upx
behavioral1/memory/2936-79-0x0000000000400000-0x0000000000463000-memory.dmp	upx
behavioral1/memory/1548-167-0x0000000000400000-0x0000000000463000-memory.dmp	upx
behavioral1/memory/1548-204-0x0000000000400000-0x0000000000463000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93ba341615ec9cad286cffa7d5b8e79e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93ba341615ec9cad286cffa7d5b8e79e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93ba341615ec9cad286cffa7d5b8e79e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2204	1548	93ba341615ec9cad286cffa7d5b8e79e_JaffaCakes118.exe	28
PID 1548 wrote to memory of 2204	1548	93ba341615ec9cad286cffa7d5b8e79e_JaffaCakes118.exe	28
PID 1548 wrote to memory of 2204	1548	93ba341615ec9cad286cffa7d5b8e79e_JaffaCakes118.exe	28
PID 1548 wrote to memory of 2204	1548	93ba341615ec9cad286cffa7d5b8e79e_JaffaCakes118.exe	28
PID 1548 wrote to memory of 2936	1548	93ba341615ec9cad286cffa7d5b8e79e_JaffaCakes118.exe	30
PID 1548 wrote to memory of 2936	1548	93ba341615ec9cad286cffa7d5b8e79e_JaffaCakes118.exe	30
PID 1548 wrote to memory of 2936	1548	93ba341615ec9cad286cffa7d5b8e79e_JaffaCakes118.exe	30
PID 1548 wrote to memory of 2936	1548	93ba341615ec9cad286cffa7d5b8e79e_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\93ba341615ec9cad286cffa7d5b8e79e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\93ba341615ec9cad286cffa7d5b8e79e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\Temp\93ba341615ec9cad286cffa7d5b8e79e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\93ba341615ec9cad286cffa7d5b8e79e_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2204
- C:\Users\Admin\AppData\Local\Temp\93ba341615ec9cad286cffa7d5b8e79e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\93ba341615ec9cad286cffa7d5b8e79e_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\875A.AC8

Filesize
1KB

MD5
44f4c6b687e745f56af2873b6f27c8bf

SHA1
57fdefaa0895e0edd9cac29509b463a2e3826200

SHA256
365662345e2a7fbf09a39a7e7beec81d1ba5f3539e0622d88b3a66ac5e62c309

SHA512
980fe7eb272ee4320e7908ba0ff97c4a0b32a6feb0b44caaa8b50686f4661120a1af0179b0d24664c18fbfeb111461bad367976b91f7aab0073abfdf780f906e

Download Submit
C:\Users\Admin\AppData\Roaming\875A.AC8

Filesize
600B

MD5
07ec8e7df6c9004e677ec17c133435c9

SHA1
c88c2124ac1794c855af1f58bfb7e299a7f1a2db

SHA256
2e4c2844f924d58630e58bc1c334204765a091dae62158d28b6a7b2d2096fac9

SHA512
ddd7527d92c687ca7b375c8e7bebbb9d2032014e4d6269f36f4973e0acfe43ce7dae06852396b632b69c43d1daa26eb0ab8a0f82758aaa65bdc98796f35874f7

Download Submit
C:\Users\Admin\AppData\Roaming\875A.AC8

Filesize
996B

MD5
fd243256ad2dbe7ad64b1386de6099ea

SHA1
cf5890eee8fbc77643c7327d5a1068426229d0ec

SHA256
e5151c9a364cfed3cdf668d4658129f20be722c6e5eb4dcf8285866ffd45dfd5

SHA512
5c112ea9c57a28b556b4a9b851662b3ce90fafeac842868dfc6b1e8fdcee94de5a911e65aed03470604d85597cd76787ca574c6d8d64d8495af5adef8ec91276

Download Submit
memory/1548-1-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1548-2-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1548-14-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1548-167-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1548-204-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2204-5-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2204-7-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2936-79-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download

Analysis

Sharing