cycbot | a0b93757519a86a73f2d226ffcab7c3a35da8d6ff3d896390e9dab282a03cf2b

General

Target

d7e170eda787edd83e23f5f10d34513b_JaffaCakes118.exe
Size

176KB
MD5

d7e170eda787edd83e23f5f10d34513b
SHA1

4771f4f01e0a005cd60201fd4eeddd0827063d4f
SHA256

a0b93757519a86a73f2d226ffcab7c3a35da8d6ff3d896390e9dab282a03cf2b
SHA512

ffc7b11e49caf0f5d80eccfc430d008e3352432215e6f8404989f85fc3372f42a45acab9fb8675e9c4a7b316819714210edae7889b2474ccf2359e9a1e6b2826
SSDEEP

3072:wyjz0A92Mm50TC5JAvALmBgGm75iw8e5qi6sYuMf/Wz3bpUzG3i+bmpjCL7PF:ljzh92Vh5JWomqGm74e5gV/WniQm1Cd

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2460-7-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/2644-15-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/3060-76-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/2644-187-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2644-2-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2460-5-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2460-7-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2644-15-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/3060-74-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/3060-76-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2644-187-0x0000000000400000-0x000000000044B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7e170eda787edd83e23f5f10d34513b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7e170eda787edd83e23f5f10d34513b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7e170eda787edd83e23f5f10d34513b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2460	2644	d7e170eda787edd83e23f5f10d34513b_JaffaCakes118.exe	31
PID 2644 wrote to memory of 2460	2644	d7e170eda787edd83e23f5f10d34513b_JaffaCakes118.exe	31
PID 2644 wrote to memory of 2460	2644	d7e170eda787edd83e23f5f10d34513b_JaffaCakes118.exe	31
PID 2644 wrote to memory of 2460	2644	d7e170eda787edd83e23f5f10d34513b_JaffaCakes118.exe	31
PID 2644 wrote to memory of 3060	2644	d7e170eda787edd83e23f5f10d34513b_JaffaCakes118.exe	33
PID 2644 wrote to memory of 3060	2644	d7e170eda787edd83e23f5f10d34513b_JaffaCakes118.exe	33
PID 2644 wrote to memory of 3060	2644	d7e170eda787edd83e23f5f10d34513b_JaffaCakes118.exe	33
PID 2644 wrote to memory of 3060	2644	d7e170eda787edd83e23f5f10d34513b_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\d7e170eda787edd83e23f5f10d34513b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d7e170eda787edd83e23f5f10d34513b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Users\Admin\AppData\Local\Temp\d7e170eda787edd83e23f5f10d34513b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d7e170eda787edd83e23f5f10d34513b_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2460
- C:\Users\Admin\AppData\Local\Temp\d7e170eda787edd83e23f5f10d34513b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d7e170eda787edd83e23f5f10d34513b_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\D047.E00

Filesize
1KB

MD5
59ecac2488f13219329695be85887556

SHA1
4c8256f0d853f6eab5296f9d5ad16dcc86f3e860

SHA256
5ffd9f2e8c8bdbe01295f036b43a5e9d5dd79714f040d3e8d294aaceec104432

SHA512
1af5fc39e991edd1f9775606d52f04969bc7826a9279ad79bc98124d44e7c6ab2d2b4a741e64d76617dbfb993091ebe55e54db086ba012175159135118f2da3a

Download Submit
C:\Users\Admin\AppData\Roaming\D047.E00

Filesize
600B

MD5
8237481bbc21e2a4b688f7aceb32b17f

SHA1
d192497c55bc80fc18b25c77726ab22730807d93

SHA256
d8d5be67460b3886bfca20b449d410eb0be144d309aacbff4c0c1f9a9a1cb18e

SHA512
eac8a0e825820c2383e5aad5cb257359ff306d35b14bc26be917e296845acbc510fcffcb9a62ce130576abf6e4bb1a087403b8da6c853f047e80f8e693f3dbe8

Download Submit
C:\Users\Admin\AppData\Roaming\D047.E00

Filesize
996B

MD5
b296ddd238c17dbcf59a84e4aec71dc2

SHA1
4b550e072b026f880c998a818bc230b8768766e3

SHA256
94125d9be3ad454a9205e8db36604ae8e2b9a6843a737091d8a9b13d3ad9d3b4

SHA512
82f43065f378f615bd6014e4487e099d7253707727beac2b589435f149ba845cbd1bc842a707f087fe0dd8f115b4be4043dbed85fedf2bf6b14c59fcb295da01

Download Submit
memory/2460-5-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2460-7-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2644-1-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2644-2-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2644-15-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2644-187-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3060-74-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3060-76-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download

Analysis

Sharing