cycbot | 899d4bd59decc342a84f91db4333a8e171792b6e6ef09dc03952187d965c76aa

General

Target

d642c4afd66e73bd3301b521e1868320_JaffaCakes118.exe
Size

185KB
MD5

d642c4afd66e73bd3301b521e1868320
SHA1

49db0f732abd4d60dea25d373d0dc5c1db7cd39d
SHA256

899d4bd59decc342a84f91db4333a8e171792b6e6ef09dc03952187d965c76aa
SHA512

0f18a92bc18f8266ff500a9e9cf76b4b4a504ca01ad036cb5ba7681d9d6fab749c695c007acb90a7fcc384b11193e8ebd623c22164170cc449c3ae6faf490e78
SSDEEP

3072:Q3y9TNgua+mBuaH7l5nmOD6st4S5xAOoujmDX8JXAOeHcdOUO9Xtq0tw4c:moN0+m8OllD6JqxeujU8JXGcwt1tXwb

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/4392-14-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/1468-15-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/1468-16-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral2/memory/456-121-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/1468-300-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1468-2-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4392-12-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4392-14-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/1468-15-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/1468-16-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/456-121-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/1468-300-0x0000000000400000-0x0000000000455000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d642c4afd66e73bd3301b521e1868320_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d642c4afd66e73bd3301b521e1868320_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d642c4afd66e73bd3301b521e1868320_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 4392	1468	d642c4afd66e73bd3301b521e1868320_JaffaCakes118.exe	84
PID 1468 wrote to memory of 4392	1468	d642c4afd66e73bd3301b521e1868320_JaffaCakes118.exe	84
PID 1468 wrote to memory of 4392	1468	d642c4afd66e73bd3301b521e1868320_JaffaCakes118.exe	84
PID 1468 wrote to memory of 456	1468	d642c4afd66e73bd3301b521e1868320_JaffaCakes118.exe	87
PID 1468 wrote to memory of 456	1468	d642c4afd66e73bd3301b521e1868320_JaffaCakes118.exe	87
PID 1468 wrote to memory of 456	1468	d642c4afd66e73bd3301b521e1868320_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\d642c4afd66e73bd3301b521e1868320_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d642c4afd66e73bd3301b521e1868320_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Users\Admin\AppData\Local\Temp\d642c4afd66e73bd3301b521e1868320_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d642c4afd66e73bd3301b521e1868320_JaffaCakes118.exe startC:\Program Files (x86)\LP\A05F\D7E.exe%C:\Program Files (x86)\LP\A05F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4392
- C:\Users\Admin\AppData\Local\Temp\d642c4afd66e73bd3301b521e1868320_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d642c4afd66e73bd3301b521e1868320_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\F91EE\71DA0.exe%C:\Users\Admin\AppData\Roaming\F91EE
  2⤵
  - System Location Discovery: System Language Discovery
  PID:456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\F91EE\E93D.91E

Filesize
996B

MD5
de0f2e0a3f31596e45073ba119c4348a

SHA1
63b2bccee94050a52500b1d1da31761427fd3240

SHA256
477dd8b91de2bf9fc140fa34d9a643504abd2f977bf0eb84792e8bff135ebd33

SHA512
dc5a7a4d85136ff8fb122a21c76e403a0daa8a5819e524da9ee771e63f345b4422e69a81d9815ac2614400f72981647bcc406abea45d44acb71eaec9c4ccdc89

Download Submit
C:\Users\Admin\AppData\Roaming\F91EE\E93D.91E

Filesize
600B

MD5
a4908a9b2ae30d58cc3c6beb7349c11d

SHA1
2cb9a4a77326bb59b61319e0f1c18411a8294c81

SHA256
35075d44f1dc388f844b84a881f2456b7276bbe367489806bf1c7db90d4eb404

SHA512
55f459099b61a5b2f751a4e2143750811e16bc171a9c61661e627b51d1d94df2c230dbbed5e5e1159dd023080c291a74ecc45fc200bfa5812e6bfe0aa364bf18

Download Submit
C:\Users\Admin\AppData\Roaming\F91EE\E93D.91E

Filesize
1KB

MD5
174fa7de6885c4c3154e01bc66482c1d

SHA1
2da76cfb2ffe39ffcf1fc4d92593e665fed6cd0f

SHA256
d0ebedc5d4fb3eb6f9049b9d00cb5f7dd49fc88151ba5c705d38495b745dde01

SHA512
cf503678ca8100f5ba80eb2e23a4ddd686aacabb95b6ba9aa63e24b703cffb7271f1cff3f4f1401e7e42c1e98e402aacf9f23bcd1837348ca9e6845dfc3e31f7

Download Submit
memory/456-121-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1468-1-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1468-2-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1468-15-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1468-16-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1468-300-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4392-12-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4392-11-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4392-14-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing