cycbot | 5973ee91578b37d5b391d4a4d812db9c930fe7532c68a389e3428b8cb71fe0d2

General

Target

e02574befc9fe1ccc10486f54caf28af_JaffaCakes118.exe
Size

182KB
MD5

e02574befc9fe1ccc10486f54caf28af
SHA1

5aa2a665f0e1061ca62ef373226b714a776640eb
SHA256

5973ee91578b37d5b391d4a4d812db9c930fe7532c68a389e3428b8cb71fe0d2
SHA512

9daa2f10c67e8224dd4fd61a6342fc3969103cf1c0385a294b838a9ceb5ec24c8b576053f227e1d10550387218dadad47246548851848ec73f3b36b32f83c988
SSDEEP

3072:wJVqamU0XhVZ30VxtqFZjqV4vw/1v9SvMTBB1E3faf3OLYUku/7zTi0F:4LmUwZ3Uaw/PSvMTJE3famMu/Li0F

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2772-14-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2964-15-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/1928-80-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2964-156-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2964-2-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2772-12-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2772-14-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2964-15-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1928-80-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2964-156-0x0000000000400000-0x000000000044E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e02574befc9fe1ccc10486f54caf28af_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e02574befc9fe1ccc10486f54caf28af_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e02574befc9fe1ccc10486f54caf28af_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2772	2964	e02574befc9fe1ccc10486f54caf28af_JaffaCakes118.exe	30
PID 2964 wrote to memory of 2772	2964	e02574befc9fe1ccc10486f54caf28af_JaffaCakes118.exe	30
PID 2964 wrote to memory of 2772	2964	e02574befc9fe1ccc10486f54caf28af_JaffaCakes118.exe	30
PID 2964 wrote to memory of 2772	2964	e02574befc9fe1ccc10486f54caf28af_JaffaCakes118.exe	30
PID 2964 wrote to memory of 1928	2964	e02574befc9fe1ccc10486f54caf28af_JaffaCakes118.exe	32
PID 2964 wrote to memory of 1928	2964	e02574befc9fe1ccc10486f54caf28af_JaffaCakes118.exe	32
PID 2964 wrote to memory of 1928	2964	e02574befc9fe1ccc10486f54caf28af_JaffaCakes118.exe	32
PID 2964 wrote to memory of 1928	2964	e02574befc9fe1ccc10486f54caf28af_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\e02574befc9fe1ccc10486f54caf28af_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e02574befc9fe1ccc10486f54caf28af_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\e02574befc9fe1ccc10486f54caf28af_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e02574befc9fe1ccc10486f54caf28af_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2772
- C:\Users\Admin\AppData\Local\Temp\e02574befc9fe1ccc10486f54caf28af_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e02574befc9fe1ccc10486f54caf28af_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\3005.47A

Filesize
1KB

MD5
285da095368f9c3d2d6009e67228d78c

SHA1
19468ffda8aeb40a7fbca18e469c3ad7258dc583

SHA256
7e65a5e7c8c1d64820ef4168a000aca2dface6f85c7b022e7f95a2ccad3c90b5

SHA512
054bd58ae70a8ad21a1c9dcc9912279ba94e8c786311d8de03cd2abe178c035867f65b7eb5b7133b3a7549224c12637adf6efdae53596405ec14f851b30cf80b

Download Submit
C:\Users\Admin\AppData\Roaming\3005.47A

Filesize
600B

MD5
bf0b5d3d57fa865d7b801f0b6f3bbe07

SHA1
4911a0dca3256ca788f7dd1fe08a18430fa63eb6

SHA256
0f02cb465b4aa4e1966eb6ef72da5dea4e56fa0dc82e7e728893c3a5fe4fe035

SHA512
b3a9eb9dba1c6530c89e1184f0dba139f8bb4bce5f2779856e8c201cd1bbaeff378fb38fd7620f3a1b60ecf82ded75771e6137f5b5df0d7f1ada9ce21c12e447

Download Submit
C:\Users\Admin\AppData\Roaming\3005.47A

Filesize
996B

MD5
bbb97c8f1b12a2aab29f7953bf13cc4c

SHA1
440dd1ba180accafe94bc546ad8b7c25cc8e48b6

SHA256
a98107416237dceadbadce568582c78f531f66f401c48cd10033d1954f5f6eb7

SHA512
4b85bbc1c5664fbf5eb1c1caa40e58b48e0f04cddc05f8c7a3dc22ef44c07b5648d25ebd6109aa7f1e8c4c88ea86cddb1726f821e72686ad2263e4429373f6ae

Download Submit
memory/1928-80-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2772-12-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2772-14-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2964-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2964-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2964-15-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2964-156-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing