cycbot | 062bcf9f9c97976b38f50c32f80c0ff02f4ffb408d25381af3787b99d5a265e2

General

Target

d4488bfe8279954d269b21659e0cab46_JaffaCakes118.exe
Size

191KB
MD5

d4488bfe8279954d269b21659e0cab46
SHA1

24256674aba5dbc7c129f12731623076db909107
SHA256

062bcf9f9c97976b38f50c32f80c0ff02f4ffb408d25381af3787b99d5a265e2
SHA512

becd4b1c8d616155cb7430e684ca0a54815d23e9284598bdfa78ace4ea530fbbe2e4cc9e4a252722c39302aabd191fa8c4248a15ca61f5321097dbdadc810ddf
SSDEEP

3072:vH8PiU4MMRHR3Sosv17FZa1evY6phG7M9pJ/mCT+CSpGiqAk4ON:vZUDMRxvsvA1QYikM3J/mCTaPq

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2484-7-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2676-15-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2892-76-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2676-181-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2676-1-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2484-4-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2484-5-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2484-7-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2676-15-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2892-75-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2892-76-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2676-181-0x0000000000400000-0x000000000046A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4488bfe8279954d269b21659e0cab46_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4488bfe8279954d269b21659e0cab46_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4488bfe8279954d269b21659e0cab46_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2484	2676	d4488bfe8279954d269b21659e0cab46_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2484	2676	d4488bfe8279954d269b21659e0cab46_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2484	2676	d4488bfe8279954d269b21659e0cab46_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2484	2676	d4488bfe8279954d269b21659e0cab46_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2892	2676	d4488bfe8279954d269b21659e0cab46_JaffaCakes118.exe	32
PID 2676 wrote to memory of 2892	2676	d4488bfe8279954d269b21659e0cab46_JaffaCakes118.exe	32
PID 2676 wrote to memory of 2892	2676	d4488bfe8279954d269b21659e0cab46_JaffaCakes118.exe	32
PID 2676 wrote to memory of 2892	2676	d4488bfe8279954d269b21659e0cab46_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\d4488bfe8279954d269b21659e0cab46_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d4488bfe8279954d269b21659e0cab46_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Users\Admin\AppData\Local\Temp\d4488bfe8279954d269b21659e0cab46_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d4488bfe8279954d269b21659e0cab46_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2484
- C:\Users\Admin\AppData\Local\Temp\d4488bfe8279954d269b21659e0cab46_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d4488bfe8279954d269b21659e0cab46_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\10DF.C8E

Filesize
1KB

MD5
13a212213b2b506be1df8e8fb93d6999

SHA1
ccb341dcc4aad22f65371d0c7e08dba58da26a5c

SHA256
d751bda1f2de46891be00060b950db9bd793e64ad6ee34d90dbae50537a1ff77

SHA512
e7b891f05f532e793ed4c7a5d1866d7292a0edd7f5ea948b25c7147c7f72e33c13b66978bae82cde05d58c69f554230232d23a20735ae4daea0f7715ece6f77c

Download Submit
C:\Users\Admin\AppData\Roaming\10DF.C8E

Filesize
600B

MD5
eeef2e711adea06d05699af4b1e287bf

SHA1
0be3547ff1210e2a5447fbb32d872061e9ef2a39

SHA256
8fb4d5a830991ef7eacfd39791d7e877f095c44f58adaef7e5c98d438bc4196a

SHA512
edc08cdcff7fb6a2fc4a9c1f46df3821d74af8ae84bcf1647472126e4ea2eac7026036077b3682c29a8b6cdc69f4c67d4b81987f29568961ead961a5f6cc1472

Download Submit
C:\Users\Admin\AppData\Roaming\10DF.C8E

Filesize
996B

MD5
9a78c7185c20a01836b046b7adab8c8c

SHA1
f2ded5159b9009c2fb9bb9df6500404a0cf5fc2f

SHA256
e9eea69355149bbad686d2f4a77bf1b071a8ed772a44dced0156271cb9f024a1

SHA512
e15e613cbb15b7ea0b32c8e3aeb7e158346db59de476e3ff39460f9a0f6d91dd31c27fc0ba40929fb30a6883fe3ff8fbf5c084e22fbd63e9e9719fd708ae61b2

Download Submit
memory/2484-4-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2484-5-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2484-7-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2676-1-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2676-15-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2676-181-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2892-75-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2892-76-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2892-74-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing