cycbot | eb548181ee69a324ac1120beaa1e52449311f861001017294c284b5b7474ade1

General

Target

d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118.exe
Size

175KB
MD5

d69a72bb30a04545e9bf4abe245d3630
SHA1

3fda4656f69f9aab573ee71a5a3fbc4dfa222a0e
SHA256

eb548181ee69a324ac1120beaa1e52449311f861001017294c284b5b7474ade1
SHA512

bde34d26496226809e37549a22508e2461afd72cf139f1aad88173272a54de7d8dbc5ba34b64b2402023792aba49ef45225a67d3e336283cb747559f14ee3e7e
SSDEEP

3072:jbo/D0tSi4V6PecwoCKpY7bYt8m9wF/ZkGq/BdOt8NTH9q+5jkkS9:j4WSpV6Pecdn67bY6/kbjPAr

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1536-12-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/1536-13-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/3028-15-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/2212-80-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/3028-151-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3028-2-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1536-12-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1536-13-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/3028-15-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2212-79-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2212-80-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/3028-151-0x0000000000400000-0x000000000046C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1536	3028	d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118.exe	30
PID 3028 wrote to memory of 1536	3028	d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118.exe	30
PID 3028 wrote to memory of 1536	3028	d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118.exe	30
PID 3028 wrote to memory of 1536	3028	d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118.exe	30
PID 3028 wrote to memory of 2212	3028	d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118.exe	32
PID 3028 wrote to memory of 2212	3028	d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118.exe	32
PID 3028 wrote to memory of 2212	3028	d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118.exe	32
PID 3028 wrote to memory of 2212	3028	d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1536
- C:\Users\Admin\AppData\Local\Temp\d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d69a72bb30a04545e9bf4abe245d3630_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\F81F.812

Filesize
1KB

MD5
b4ec9c591fb8aaa4585bfbbdf67aaefd

SHA1
a17af7d54330697ac3e80f39db79b32845a9db75

SHA256
febd416029d854988734ec8ed3ecb2b65c90e122becc80de115a194efc867d06

SHA512
5d7c99f5ae14dce72e55153a67d582c657cfcbc08e4b331e0bd5a041e755427c8d17f2750639baa9e9cd88a220da29902048c4a8fd52f439d5f66d0b9b3ea3a1

Download Submit
C:\Users\Admin\AppData\Roaming\F81F.812

Filesize
600B

MD5
4d94e2c4a5bf7cd94d0199c4618bfb9a

SHA1
5bc95c3f5ce30130209b878af2ed6e9ad017485f

SHA256
31536b2f44ae067f9a91037642be2d54d80046db37baafdaf0a0ebb7fb80e57d

SHA512
b1654a6e1e554835745dde7d91a1d267b705f2fa7aed85a7dd06a4fc614ebc39d2ac5d515f2a0741930c4f1c1b9083b3fdccf70f7ec924f8f8318c7c54160167

Download Submit
C:\Users\Admin\AppData\Roaming\F81F.812

Filesize
996B

MD5
cb285d862146c2ce2ce8dce114c01985

SHA1
ab614e8f66c4e79ead0905dc552d91832c9d85de

SHA256
b2822c90dbd653bdfdda57958e2cc5b134f8c0bff585daed2756498ba29aa24a

SHA512
3d945ab863fca256e1310939316d33a0ccf4eeccdc65b00d5309836307b5ea23de9dc4428fb989242e4eacdfd923ad90a8c6db6527978479ecf28639fc469678

Download Submit
memory/1536-12-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1536-13-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2212-79-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2212-80-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3028-1-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3028-2-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3028-15-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3028-151-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing