cycbot | 4fd07e4ba860cf2e651889e12511af622472194b80869ed10334d8575e4fcdb7

General

Target

d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe
Size

186KB
MD5

d3077250c4e3349bc0d512030cf04469
SHA1

b0c3ac8518b484100b9d61c43bf930a8f007c784
SHA256

4fd07e4ba860cf2e651889e12511af622472194b80869ed10334d8575e4fcdb7
SHA512

67bc93775488e743ff1d10f537eb25811d22915f03e4d0a21c349eb8b24540b4e42d3292877e1ac6a5c270b36f7470d0a1813faefcc9e3efc731e20066135eb4
SSDEEP

3072:UX7KBgA6xRQqW/w/8gT2ayPiN8IL6GTYgoL+gl3vY8Nf:UrKB96x5WuKiCInTal3vDf

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/2500-12-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral2/memory/1236-14-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral2/memory/4052-75-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral2/memory/1236-191-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1236-2-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/2500-12-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/1236-14-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/4052-74-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/4052-75-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/1236-191-0x0000000000400000-0x000000000044E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 2500	1236	d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe	82
PID 1236 wrote to memory of 2500	1236	d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe	82
PID 1236 wrote to memory of 2500	1236	d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe	82
PID 1236 wrote to memory of 4052	1236	d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe	87
PID 1236 wrote to memory of 4052	1236	d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe	87
PID 1236 wrote to memory of 4052	1236	d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Local\Temp\d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2500
- C:\Users\Admin\AppData\Local\Temp\d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\E937.5A6

Filesize
1KB

MD5
b53a576ab5a2636a1856d9378406db9c

SHA1
367ac4dfca106f03a9419219f144bc133cd32f8e

SHA256
c4eb3ad9da10b5893cdc509e2fe727e889aa3ca8dfd503dbe6fb20114e354bc9

SHA512
224d961b7d01b084177fe9c389354df7b3c17e140b02b802702ab7b045931a0975bb49a0e35db21c820ce626fec50f6df6cf0ebb084cba2d5f751c8c5a0083c4

Download Submit
C:\Users\Admin\AppData\Roaming\E937.5A6

Filesize
600B

MD5
7d5ec22c8e269fdb6c77e9d74608dfa1

SHA1
ce5736c616536565aa8098429823752ed692d4e5

SHA256
74a041cade6aca90ff4fb7e3b2b2308284f52ad97ac6fe66ec9d54fe1f1515b5

SHA512
af2031e2b7258815a9168d71ea8a34d66baf400a8beaa2556e7bd48dbbfef91ce9bed89a5ef0fab38cf95bc0b6ecb1134ffd4c6e4ba818fc554ad6ecebde1929

Download Submit
C:\Users\Admin\AppData\Roaming\E937.5A6

Filesize
996B

MD5
37170db446b021d15c0a57bec09c4b44

SHA1
902fa92eb551df7a70f12bf9e7d44c90e82f76ec

SHA256
9f895d2464cbcbddbebd6f9eaf748e8270909fad81e26834379c60d296b2078b

SHA512
91e670ab60d10301235be299e3338076f735bdb5e4b4372cb40bf14891e0c98175245190ba1e15809e90633ceed63b71daee5fe88bd32fed28f7849e41b094f7

Download Submit
memory/1236-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1236-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1236-14-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1236-191-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2500-12-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4052-73-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4052-74-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4052-75-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing