cycbot | fccc86ae3430b5816c891e8b8425bd49fc8f0e9d7fa523199b67d9c279d2e4dd

General

Target

d5624689ee615f9503b4d85f151044a7_JaffaCakes118.exe
Size

170KB
MD5

d5624689ee615f9503b4d85f151044a7
SHA1

de0fd513a529c8f5f736ab4b82c7b18e7bdb1df9
SHA256

fccc86ae3430b5816c891e8b8425bd49fc8f0e9d7fa523199b67d9c279d2e4dd
SHA512

203c1caa587760ce8fca0c89c16d3291fc85bd9a8452ebc7a01c591223236d5a54b7ceaf4f0243c90a88ff2f0f6f2d42c15cf2771e335a8b6978503255394edb
SSDEEP

3072:YBj3OovdbTMucfSTk5trgIOtComxDBqdpD:YBDP2uRTEXOtZmaX

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/780-10-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral2/memory/2220-14-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral2/memory/4276-93-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral2/memory/2220-210-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2220-2-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/memory/780-8-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/memory/780-10-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/memory/2220-14-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/memory/4276-91-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/memory/4276-93-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/memory/2220-210-0x0000000000400000-0x000000000046B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d5624689ee615f9503b4d85f151044a7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d5624689ee615f9503b4d85f151044a7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d5624689ee615f9503b4d85f151044a7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 780	2220	d5624689ee615f9503b4d85f151044a7_JaffaCakes118.exe	83
PID 2220 wrote to memory of 780	2220	d5624689ee615f9503b4d85f151044a7_JaffaCakes118.exe	83
PID 2220 wrote to memory of 780	2220	d5624689ee615f9503b4d85f151044a7_JaffaCakes118.exe	83
PID 2220 wrote to memory of 4276	2220	d5624689ee615f9503b4d85f151044a7_JaffaCakes118.exe	84
PID 2220 wrote to memory of 4276	2220	d5624689ee615f9503b4d85f151044a7_JaffaCakes118.exe	84
PID 2220 wrote to memory of 4276	2220	d5624689ee615f9503b4d85f151044a7_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\d5624689ee615f9503b4d85f151044a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d5624689ee615f9503b4d85f151044a7_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\d5624689ee615f9503b4d85f151044a7_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d5624689ee615f9503b4d85f151044a7_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:780
- C:\Users\Admin\AppData\Local\Temp\d5624689ee615f9503b4d85f151044a7_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d5624689ee615f9503b4d85f151044a7_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\1B59.FB3

Filesize
1KB

MD5
d2d23e6e766343e923cd1f8f360f858e

SHA1
2218ed99290f915e98879ce6721caf8f241aa238

SHA256
1ad478911168a440e1a2e803f94a43d23a38fcfc11dfac6f466e209bbb2c7212

SHA512
9fbf5c2bc1c7c60ef5e064eab0a9257a78f77cf081668052fdd7fa76fd0b8d96ceead6a672c5ef3ad56e9e725185a7303fa0983a41c15d41fea00bb748ffd319

Download Submit
C:\Users\Admin\AppData\Roaming\1B59.FB3

Filesize
600B

MD5
40f2909a03dcd3aeb081e5c66180fd53

SHA1
772a9006f8b0f5f2b72e4727952aef57bc28f07e

SHA256
74a32ac37beeabb42adc43d9d11c6f441f2426a571d48bd0a9eefa35aa376e92

SHA512
ed76b029df3fb6287ecbaaf49169da34821a805b4c909bb92f0bec045b0b64b8fa33f9d1200ce0129364b1d5391cc154c057e5011d689545688882a2bf38b104

Download Submit
C:\Users\Admin\AppData\Roaming\1B59.FB3

Filesize
996B

MD5
163e77ab1e1812651741e8b63a8e9fb8

SHA1
de7013f9567d59a8731b1a1fec58575dc7ac8477

SHA256
289719ccb2b776b9acdc04b1ed6d9c73a1953ea5f79c2b7fa3ad4940ebec483b

SHA512
f05876c3a99f647cd3052dcb551931aaec954776f42b655b3b4dc2f44307134fd958020d3b288a95ff07a9715376906b135413d14b50a353336d93dc49b1d4e7

Download Submit
memory/780-8-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/780-10-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2220-1-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2220-2-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2220-14-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2220-210-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/4276-90-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/4276-91-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/4276-93-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing