cycbot | b55b4feeb47027355a90408d646e59a0e2a713e6844a4eedafdb3306dae5ef3d

General

Target

cba945ba02513bf7718cf1eb4928c9bb_JaffaCakes118.exe
Size

176KB
MD5

cba945ba02513bf7718cf1eb4928c9bb
SHA1

9d0e337b273a6d86ab1d225e2f8114764dba2702
SHA256

b55b4feeb47027355a90408d646e59a0e2a713e6844a4eedafdb3306dae5ef3d
SHA512

d406dca702d3f29c9fe360a8a6f1a3b6678a3df821b85496f030b0dde6f801f96374649d694680f6569d1b428b84d856f7ff4dcb3350ea1296bc0aa5ad965f60
SSDEEP

3072:SsqaCGaja8sDzVAN03dEoK5GFCpmyXpL23nmGAMftzShQKoQ9VA+p6WT0oTBgHtg:JAvjaFDSFod6oftWhQKomIm0150

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2540-10-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/3008-21-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/1668-81-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/3008-182-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3008-2-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2540-8-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2540-7-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2540-10-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/3008-21-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/1668-81-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/3008-182-0x0000000000400000-0x000000000044B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cba945ba02513bf7718cf1eb4928c9bb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cba945ba02513bf7718cf1eb4928c9bb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cba945ba02513bf7718cf1eb4928c9bb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2540	3008	cba945ba02513bf7718cf1eb4928c9bb_JaffaCakes118.exe	30
PID 3008 wrote to memory of 2540	3008	cba945ba02513bf7718cf1eb4928c9bb_JaffaCakes118.exe	30
PID 3008 wrote to memory of 2540	3008	cba945ba02513bf7718cf1eb4928c9bb_JaffaCakes118.exe	30
PID 3008 wrote to memory of 2540	3008	cba945ba02513bf7718cf1eb4928c9bb_JaffaCakes118.exe	30
PID 3008 wrote to memory of 1668	3008	cba945ba02513bf7718cf1eb4928c9bb_JaffaCakes118.exe	33
PID 3008 wrote to memory of 1668	3008	cba945ba02513bf7718cf1eb4928c9bb_JaffaCakes118.exe	33
PID 3008 wrote to memory of 1668	3008	cba945ba02513bf7718cf1eb4928c9bb_JaffaCakes118.exe	33
PID 3008 wrote to memory of 1668	3008	cba945ba02513bf7718cf1eb4928c9bb_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\cba945ba02513bf7718cf1eb4928c9bb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cba945ba02513bf7718cf1eb4928c9bb_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Local\Temp\cba945ba02513bf7718cf1eb4928c9bb_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\cba945ba02513bf7718cf1eb4928c9bb_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2540
- C:\Users\Admin\AppData\Local\Temp\cba945ba02513bf7718cf1eb4928c9bb_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\cba945ba02513bf7718cf1eb4928c9bb_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\8BE0.0C1

Filesize
1KB

MD5
6e271102e3fa90ed1830c1527d61b8a8

SHA1
69ea2f2cd0db79e9fe52de4f8e1ef5043c9ada3a

SHA256
6a2a20dce9635fdc43d16052502621923a21af6007a5b20de23144d38240f022

SHA512
ee1920bff745a60d2c44e9b6e6e723a63c779da1138e86d733029385ea4bc3cfaec02b989fc08acb47992d0c598c8854847b773568067f48ecdbc9fa2bb1e770

Download Submit
C:\Users\Admin\AppData\Roaming\8BE0.0C1

Filesize
597B

MD5
a345ee552fb374d67cbfb93909748e65

SHA1
c4b3da155620e619b1c6144ea102c1054aa39f67

SHA256
d6ede281f374dc5293fb68b4df0777d6499316adcb4c1b8f808e63e2693d5eee

SHA512
2026684c0ba2497cdaa5f585bd2a3978b9ebccc5cc28cb149f3845f426055dc73388025df4040117f9d2a5862be8ac1cd7ba4a058a0743d10e309a1caabeacf5

Download Submit
C:\Users\Admin\AppData\Roaming\8BE0.0C1

Filesize
1KB

MD5
9371154186638db90a7696fb16ee2318

SHA1
b73925941a5a8fea63e202ea4ea7dd57a11086d6

SHA256
eceeed9537878e5501b59678334ecefca3604dbf66ff24a5d4e9711880a7c89b

SHA512
91cfcb7313a3ad8dcf67e6fdef8b03cd4c1219ba9a538919030a1d5c7675742b1a81513d56ae7bd05319e524212f6dc43e11a56f85c7337c2fa10bc2309a4735

Download Submit
C:\Users\Admin\AppData\Roaming\8BE0.0C1

Filesize
897B

MD5
55725e5a3d318563de0c3986ed3e9fc0

SHA1
c9772391cdf4c3a6c2debee5af3666a02211dbfe

SHA256
7a80307b46c258916fbfba4b3e6d7fa86b834afc4b748a75e0bc2b16af5e236d

SHA512
15f23924c200d74fb9ba4d16c6c0732e5488913a33359e4ce69b19552d873c928d08a96ca72245258b54773182863867c90aaf02a885e5b2d78c5292665a5054

Download Submit
memory/1668-81-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1668-80-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2540-7-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2540-10-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2540-8-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3008-21-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3008-1-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3008-2-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3008-182-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download

Analysis

Sharing