cycbot | 508aa5c3004bee26836a4cd2f81cf56e22d7b6d9cf9dbb124a375880c16b8bde

General

Target

da609639cd6b332859be2ef83572692b_JaffaCakes118.exe
Size

182KB
MD5

da609639cd6b332859be2ef83572692b
SHA1

170b8aaaf252402369111bc90836abe17d123d58
SHA256

508aa5c3004bee26836a4cd2f81cf56e22d7b6d9cf9dbb124a375880c16b8bde
SHA512

323e976247969d4c6d85a88f5c970190786dbdeadd25aa866c43e217c6105de3c82e9453345d5e0d096df42df1f7d9f678701cc9efc2f42ce989814024592a16
SSDEEP

3072:ds4J1ymzfWOjnwGOn1UnfsofawcnZ6nf5MrAyIOJEWSfOuE6IGTm/nQ:dHJUEfo13FwuZo4JIHOu2G

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2428-14-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2160-15-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/1152-83-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2160-158-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2160-162-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2160-2-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2428-14-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2428-13-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2160-15-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1152-82-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1152-83-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2160-158-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2160-162-0x0000000000400000-0x000000000044E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da609639cd6b332859be2ef83572692b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da609639cd6b332859be2ef83572692b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da609639cd6b332859be2ef83572692b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2428	2160	da609639cd6b332859be2ef83572692b_JaffaCakes118.exe	30
PID 2160 wrote to memory of 2428	2160	da609639cd6b332859be2ef83572692b_JaffaCakes118.exe	30
PID 2160 wrote to memory of 2428	2160	da609639cd6b332859be2ef83572692b_JaffaCakes118.exe	30
PID 2160 wrote to memory of 2428	2160	da609639cd6b332859be2ef83572692b_JaffaCakes118.exe	30
PID 2160 wrote to memory of 1152	2160	da609639cd6b332859be2ef83572692b_JaffaCakes118.exe	32
PID 2160 wrote to memory of 1152	2160	da609639cd6b332859be2ef83572692b_JaffaCakes118.exe	32
PID 2160 wrote to memory of 1152	2160	da609639cd6b332859be2ef83572692b_JaffaCakes118.exe	32
PID 2160 wrote to memory of 1152	2160	da609639cd6b332859be2ef83572692b_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\da609639cd6b332859be2ef83572692b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\da609639cd6b332859be2ef83572692b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Temp\da609639cd6b332859be2ef83572692b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\da609639cd6b332859be2ef83572692b_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2428
- C:\Users\Admin\AppData\Local\Temp\da609639cd6b332859be2ef83572692b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\da609639cd6b332859be2ef83572692b_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\4964.084

Filesize
1KB

MD5
b77ed73a4bbd4a30b809657dc72fc9e3

SHA1
7b73dc50c11354efe9c1b190df1b2fff62c5ad0e

SHA256
4650db282d1de5cbf76066bef9f82b8c1fcf3f39fbafcd19b1487ff98acd2660

SHA512
1c0fe0840afe8fa79fe6fd1e7ab26722ce5b2c1b0bfa4ffbecebade55a31f84c2e438cec7da5efbcaae2d69d509eef293da1107d3034454b41407ec24b194a18

Download Submit
C:\Users\Admin\AppData\Roaming\4964.084

Filesize
600B

MD5
ab2c2dfdc1b0069b31197b7a391b7db4

SHA1
bbbced09c5c3a14fbcee19af5a58fb13de37716b

SHA256
fb62a53d79fb8c5e797f1d6b85d99cd39dc2e6b8097f5d379f9556bdb9c5c8e0

SHA512
3a92d48cd3792fa929b38151b32f4bf693486020651ae941d38e07c032ced59ca062a7979a35fc17a7b7f1544708f0bfe7ff8835cd84f975f38bdfa651ab9001

Download Submit
C:\Users\Admin\AppData\Roaming\4964.084

Filesize
996B

MD5
c8da1be2f8b75dc856f73d95e3dfb563

SHA1
ce3fcaa9481d93e25fcfda5feb4dd25481be1e92

SHA256
eb7dee22c7838c7ea92558d76495f0261bd6edfc9b50c4a271a2116be9cdb207

SHA512
ec2a2604f5262b7ccbcd997876d7ed38b049eceb2b0471995598d6053b272d2a2b3ee52c02c71d179ca06c6cefd303dd6b3eab771fa66b9657dd2a4f93d99410

Download Submit
memory/1152-82-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1152-83-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2160-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2160-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2160-15-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2160-158-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2160-162-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2428-14-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2428-13-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing