cycbot | baadc9af4d7dbec9d98bd1de225346bfc879515f67e987d48501c4da59f6d0b0

General

Target

e309aa7d1c52cac3b0f03e281d342e16_JaffaCakes118.exe
Size

197KB
MD5

e309aa7d1c52cac3b0f03e281d342e16
SHA1

ae666497af97f1c48a814d9e694273c8872e81d5
SHA256

baadc9af4d7dbec9d98bd1de225346bfc879515f67e987d48501c4da59f6d0b0
SHA512

15270bd749ff69e1bbaed52cf0c871d05090797a1c29df44440ee267dfcdc8f5bfc1b8f9921146ba42a863634445a3ff462d4dc3c43d88ffd92822c8a053eb75
SSDEEP

6144:ZhGOF3Gh261K8G+mmWgGajCAB/rZmID2pNw:ZhGig1G0GajCAB/IDpNw

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2316-7-0x0000000000400000-0x000000000044D000-memory.dmp	family_cycbot
behavioral1/memory/2256-14-0x0000000000400000-0x000000000044D000-memory.dmp	family_cycbot
behavioral1/memory/2256-72-0x0000000000400000-0x000000000044D000-memory.dmp	family_cycbot
behavioral1/memory/2420-74-0x0000000000400000-0x000000000044D000-memory.dmp	family_cycbot
behavioral1/memory/2256-162-0x0000000000400000-0x000000000044D000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2256-2-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2316-5-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2316-7-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2256-14-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2256-72-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2420-74-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2256-162-0x0000000000400000-0x000000000044D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e309aa7d1c52cac3b0f03e281d342e16_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e309aa7d1c52cac3b0f03e281d342e16_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e309aa7d1c52cac3b0f03e281d342e16_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2316	2256	e309aa7d1c52cac3b0f03e281d342e16_JaffaCakes118.exe	31
PID 2256 wrote to memory of 2316	2256	e309aa7d1c52cac3b0f03e281d342e16_JaffaCakes118.exe	31
PID 2256 wrote to memory of 2316	2256	e309aa7d1c52cac3b0f03e281d342e16_JaffaCakes118.exe	31
PID 2256 wrote to memory of 2316	2256	e309aa7d1c52cac3b0f03e281d342e16_JaffaCakes118.exe	31
PID 2256 wrote to memory of 2420	2256	e309aa7d1c52cac3b0f03e281d342e16_JaffaCakes118.exe	33
PID 2256 wrote to memory of 2420	2256	e309aa7d1c52cac3b0f03e281d342e16_JaffaCakes118.exe	33
PID 2256 wrote to memory of 2420	2256	e309aa7d1c52cac3b0f03e281d342e16_JaffaCakes118.exe	33
PID 2256 wrote to memory of 2420	2256	e309aa7d1c52cac3b0f03e281d342e16_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\e309aa7d1c52cac3b0f03e281d342e16_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e309aa7d1c52cac3b0f03e281d342e16_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\e309aa7d1c52cac3b0f03e281d342e16_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e309aa7d1c52cac3b0f03e281d342e16_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2316
- C:\Users\Admin\AppData\Local\Temp\e309aa7d1c52cac3b0f03e281d342e16_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e309aa7d1c52cac3b0f03e281d342e16_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\125F.7E4

Filesize
1KB

MD5
9592dbc6df4c0e50096de95eaf805a3f

SHA1
cd5ac19807a68d03ea372bfc29f17754108e53dc

SHA256
6454974e2d4ba07213a225f97e07203febc430f8840b4e640f8c747ea2cfe515

SHA512
a62a61aa077f322af7147c241d08f5d67016350a8275a91b82f916791b017b68ee303555f926e5c8249b2aa6a5caeed11a0c6a9ffe3d874f943ced6e4549c86c

Download Submit
C:\Users\Admin\AppData\Roaming\125F.7E4

Filesize
600B

MD5
17678a582398f8e6a062cbc07ddd3443

SHA1
c36fda7e13c4f7c547f82a2d8bec8a831e48825e

SHA256
437b48713f1f4b00376f9ea9d7d21c16c9dbfd90fa614cf0974856a47a6b9588

SHA512
712c51d32eb9a1e69be4e11d7d0f23fb873b51f8cfbb3f6aa64a5c7b48d0db309bb7a0663e43b27773f17b4cb0d3863348c1e8ff4d05ff185e7f3f527dc79b39

Download Submit
C:\Users\Admin\AppData\Roaming\125F.7E4

Filesize
996B

MD5
99231a756e1b6cbc08c59c744b425206

SHA1
e640b693264b6bdda086d7af3fbcc51474b7e328

SHA256
090663cbe83154f231f72a7a7134d9887a7da3c977b738133f3240edefed7b28

SHA512
2cb4656dbdb0919aff63da06d7d9464fda0866805d0996d7cd4c26c92898d4e9b9b7c02bfc30d7a6de9bb0b2b7eb3c1cc3a914c2eb7cc8fa3c6fd90e502b6e71

Download Submit
memory/2256-1-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2256-2-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2256-14-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2256-72-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2256-162-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2316-5-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2316-7-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2420-74-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing