cycbot | cdf7f2b9960072ecfbd8d656938fb40b7c13ecc4ac66ca784413dd95e885655c

General

Target

d31efe98088e4424f0e8d3224c1de550_JaffaCakes118.exe
Size

172KB
MD5

d31efe98088e4424f0e8d3224c1de550
SHA1

15f6c57111e7dbe9c9eea8b611a1f4096d47f3a5
SHA256

cdf7f2b9960072ecfbd8d656938fb40b7c13ecc4ac66ca784413dd95e885655c
SHA512

4860fe625d60a37feffb4fbd3192cac9cae66678d6427b0206d7e486715e8521b9399a4c0af1840a0ccef576d4fbe6d8c5f2e0efe0232e7370323cf456ebf542
SSDEEP

3072:ShazYS4GPzJov518ZFEf5I8KEORGMROymwlVehHHpnASlzlXCSLLflL/ahdFcv:GaUS9rJ05GFEfK8KbzwylyRlcSLRL/ai

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2800-14-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/528-15-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/1380-85-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/528-198-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/528-2-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2800-12-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2800-14-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/528-15-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1380-85-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/528-198-0x0000000000400000-0x000000000046C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d31efe98088e4424f0e8d3224c1de550_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d31efe98088e4424f0e8d3224c1de550_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d31efe98088e4424f0e8d3224c1de550_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 2800	528	d31efe98088e4424f0e8d3224c1de550_JaffaCakes118.exe	31
PID 528 wrote to memory of 2800	528	d31efe98088e4424f0e8d3224c1de550_JaffaCakes118.exe	31
PID 528 wrote to memory of 2800	528	d31efe98088e4424f0e8d3224c1de550_JaffaCakes118.exe	31
PID 528 wrote to memory of 2800	528	d31efe98088e4424f0e8d3224c1de550_JaffaCakes118.exe	31
PID 528 wrote to memory of 1380	528	d31efe98088e4424f0e8d3224c1de550_JaffaCakes118.exe	33
PID 528 wrote to memory of 1380	528	d31efe98088e4424f0e8d3224c1de550_JaffaCakes118.exe	33
PID 528 wrote to memory of 1380	528	d31efe98088e4424f0e8d3224c1de550_JaffaCakes118.exe	33
PID 528 wrote to memory of 1380	528	d31efe98088e4424f0e8d3224c1de550_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\d31efe98088e4424f0e8d3224c1de550_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d31efe98088e4424f0e8d3224c1de550_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:528
- C:\Users\Admin\AppData\Local\Temp\d31efe98088e4424f0e8d3224c1de550_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d31efe98088e4424f0e8d3224c1de550_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2800
- C:\Users\Admin\AppData\Local\Temp\d31efe98088e4424f0e8d3224c1de550_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d31efe98088e4424f0e8d3224c1de550_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\7877.511

Filesize
1KB

MD5
6d6cc8d321142e5284c72c53f0713026

SHA1
20ea8037fb975c78387652866929b87fb3144499

SHA256
72080b6dd5e7fdf980c1a331506b7f0cc6b024c92e26add3464b4f15961ea00c

SHA512
8b31684f4d7fcc39d79270474fdb8ee2ce7e6062e6c133c5772761bd29bcf55f4b63a217d469ad6814215532b29be0be1586f5c3c757b875cda6d9c5f69e7d32

Download Submit
C:\Users\Admin\AppData\Roaming\7877.511

Filesize
600B

MD5
ad874fc66168ca73052cfba79f3fed84

SHA1
8a8d3b07ff7525a657a8cc016d3d313826d1d92a

SHA256
9e1abcc0980205d992d2caad54de60aa270d5ee68a1afa2dde34713f3e1deafd

SHA512
70b7999089de0683b4038909890a67abda271440aeb8bfbd616cd0ea2ad8456f8fd5c82c805b01ec8b20a38125aeb31bf29f95db966c162e79264ae0fa8d42f8

Download Submit
C:\Users\Admin\AppData\Roaming\7877.511

Filesize
996B

MD5
caf10dadbe9ae3489b78eedb1479c24b

SHA1
bc0e3b1adfadc063e949d78e4343bb3c77380bd5

SHA256
c5e2f72578a0f3c23b87cc91d2f0ada3f71c5f06068e3d14903e75fb184ee20f

SHA512
b52d8cc44d500bb7d29297880bdebd4b122ef60013c6317b3100e435ba431021d8aa571a7d0104b8ed5e5b820df2cb0c2319e92073a31016967359262d2f8b0b

Download Submit
memory/528-1-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/528-2-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/528-15-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/528-198-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1380-85-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2800-12-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2800-14-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing