cycbot | b7561ee2a61654641afc2546cc8bfca40bc2ed030aa4580db0c0ff247e1633a9

General

Target

ded0460084c7687e861fecd6559047f9_JaffaCakes118.exe
Size

193KB
MD5

ded0460084c7687e861fecd6559047f9
SHA1

121c37224fd8f4394a832d0552bd14a4270a0beb
SHA256

b7561ee2a61654641afc2546cc8bfca40bc2ed030aa4580db0c0ff247e1633a9
SHA512

d6b229f3c133f8036d614ddc368b4746fa99804e85b698bf20f5fb4a2394dd0e316c6cc3a1fc863f7288a4b32381e9dfa15e9ce8a146660c79888f63f99421bb
SSDEEP

3072:AzWeAhH7QL/88Ym98FaUBEzU57C3CuTvd+0QYiu46AAFEq3RA2yROF:AaTsL/ZD+Nu7CEVNQYnvAAFlBac

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2400-6-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot
behavioral1/memory/2400-8-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot
behavioral1/memory/2376-16-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot
behavioral1/memory/1492-93-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot
behavioral1/memory/2376-191-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2376-2-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2400-6-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2400-8-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2376-16-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/1492-92-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/1492-93-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2376-191-0x0000000000400000-0x0000000000469000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ded0460084c7687e861fecd6559047f9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ded0460084c7687e861fecd6559047f9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ded0460084c7687e861fecd6559047f9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2400	2376	ded0460084c7687e861fecd6559047f9_JaffaCakes118.exe	30
PID 2376 wrote to memory of 2400	2376	ded0460084c7687e861fecd6559047f9_JaffaCakes118.exe	30
PID 2376 wrote to memory of 2400	2376	ded0460084c7687e861fecd6559047f9_JaffaCakes118.exe	30
PID 2376 wrote to memory of 2400	2376	ded0460084c7687e861fecd6559047f9_JaffaCakes118.exe	30
PID 2376 wrote to memory of 1492	2376	ded0460084c7687e861fecd6559047f9_JaffaCakes118.exe	33
PID 2376 wrote to memory of 1492	2376	ded0460084c7687e861fecd6559047f9_JaffaCakes118.exe	33
PID 2376 wrote to memory of 1492	2376	ded0460084c7687e861fecd6559047f9_JaffaCakes118.exe	33
PID 2376 wrote to memory of 1492	2376	ded0460084c7687e861fecd6559047f9_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\ded0460084c7687e861fecd6559047f9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ded0460084c7687e861fecd6559047f9_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\ded0460084c7687e861fecd6559047f9_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ded0460084c7687e861fecd6559047f9_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2400
- C:\Users\Admin\AppData\Local\Temp\ded0460084c7687e861fecd6559047f9_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ded0460084c7687e861fecd6559047f9_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\BC90.14E

Filesize
1KB

MD5
ae88349d82e4778453377fabdc436142

SHA1
458b63f8ff3c53ff71bcd03216a32f20cbd8df6d

SHA256
78cba32153f632337d70f9e51c8a69e937cde64c790166902a1b5863ea61b79d

SHA512
08fb6b324dfa38e675831d08d9e59dcf33d91a866012e577e78633099d0d2db82053bed8bb252f9f5f3e5690e63a9ef4afda690ae54b9ea1fc48353b2d7cb834

Download Submit
C:\Users\Admin\AppData\Roaming\BC90.14E

Filesize
600B

MD5
130367bde2d579d0a1a4148fe59f8ae8

SHA1
c332f5dd42b23729898b8b0d977da5e7a44f894e

SHA256
af178f2fe149879f57ea751c5498e1d29cefc4898783eff980bef8610260902e

SHA512
923c8e747cf4d281cbb90078cd5a0fab554826de389498a3f5bd46ac504267b5468dcb336eeb0a4a66f5b7ac2c16485e04ec6f055b01d234734b4cd76c73393f

Download Submit
C:\Users\Admin\AppData\Roaming\BC90.14E

Filesize
996B

MD5
b9702970e2f83c44d4fef81812f6f1b7

SHA1
ea72e31664cf631a3e3ad616ab08edd444b2060d

SHA256
49074c4420ee7a20b8e3c1a30f2b7766013fbf2c6c6e25ea7a25c427afa56b5a

SHA512
a379c8e07c6d03110f6a81fcfd875b44ca08745b49547fca7a7852cb196858622613f6b4da0cb8ee373dce413aafad11abfd54a39a2260659bfae3c54ec1b356

Download Submit
memory/1492-92-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1492-93-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2376-1-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2376-2-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2376-16-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2376-191-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2400-5-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2400-6-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2400-8-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download

Analysis

Sharing