cycbot | e90c5722c7b1a0911acfbe99c939e855d44b57c732ac860a4411929895a74669

General

Target

d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe
Size

182KB
MD5

d121faa3f6e90d545441cbc0340028d3
SHA1

0d23698099d257127c4ec31316375b1ecd6c4d8d
SHA256

e90c5722c7b1a0911acfbe99c939e855d44b57c732ac860a4411929895a74669
SHA512

2275665d9bf7e2a7e043d87c0099271d209dc0ec9e42fea650fd78e7693d368511815fb26b0496f7b19632dd1e011a766e4bf81fb63d4b4a16469f54d1067a54
SSDEEP

3072:U+A3w0NSJk5wD+hveJT7Mp2MDw9pI9R37IKIm7fgV5udVQ:b2wZJnChvC8p2MDwPICm7YV

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1064-10-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/1064-9-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2468-15-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2448-86-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2468-162-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2468-1-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1064-10-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1064-9-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1064-7-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2468-15-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2448-86-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2468-162-0x0000000000400000-0x000000000044E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 1064	2468	d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe	30
PID 2468 wrote to memory of 1064	2468	d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe	30
PID 2468 wrote to memory of 1064	2468	d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe	30
PID 2468 wrote to memory of 1064	2468	d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe	30
PID 2468 wrote to memory of 2448	2468	d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe	32
PID 2468 wrote to memory of 2448	2468	d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe	32
PID 2468 wrote to memory of 2448	2468	d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe	32
PID 2468 wrote to memory of 2448	2468	d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1064
- C:\Users\Admin\AppData\Local\Temp\d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\B09A.84F

Filesize
1KB

MD5
818ae28c022dc4c332a34d8ae10b5169

SHA1
9f10a2a0acffeffb142fdacb5a7762b4954ec03b

SHA256
7a0035cb48124eb1807c11c65d2f16b714efcb863a21ef1f45e17d64630adc63

SHA512
fda42e85f6343f36f2809d82bd135d0dbc3e7512e8a324f3aa4dbafe886659798963da29487e1db0c39e45905a3cc414c61b125083f9cba5ac629a5526a71aae

Download Submit
C:\Users\Admin\AppData\Roaming\B09A.84F

Filesize
600B

MD5
601cfba884e1e7ce9c156429465bc143

SHA1
f6b85d9628b73c0dc7a7bb81fd7c2d6cb5e2c9ad

SHA256
00618c3aa73dddee84a125163e6366ae6077674a1ed13a67b13d2c5f40dd5692

SHA512
6211f130965eca3903b676ef8b8230fd9930cce7a6f28add1dc9f09f648b2a075d818b35be9fd3280e675c2f9d0f9b198db2ba33aa1a86253d09aec9c017b95b

Download Submit
C:\Users\Admin\AppData\Roaming\B09A.84F

Filesize
996B

MD5
f38c6cc0b1ad86f74fff92277ad24ee6

SHA1
e1b4b01ad5be5cf719c1e5fc89c057bf1f09cca2

SHA256
ede371403b483b3dc2000ceb1fa101642e02273b87355c13ccee52fa60b38074

SHA512
40377d1ae5e8ae5b182ee4247a88f46fd2d27d4fe1e93548c939e082893734bae3e7d90abd799d2dd5cf1fa556d4a72a87b765404b079416c6ed65e47ff92725

Download Submit
memory/1064-10-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1064-9-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1064-7-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2448-84-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2448-86-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2468-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2468-15-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2468-162-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing