cycbot | 19d01bfb005536ae2ebb79acd2091857640ce6ef63ca96bcef0df3528aa6ba9e

General

Target

e418a310245c96fe86b85597177587e2_JaffaCakes118.exe
Size

195KB
MD5

e418a310245c96fe86b85597177587e2
SHA1

ca063d114bf8a6649983c16f29be0f845a6be345
SHA256

19d01bfb005536ae2ebb79acd2091857640ce6ef63ca96bcef0df3528aa6ba9e
SHA512

cd5598d1bcc28694f4d00909223ef2a5cc81624b5666b0af7b6d6c4d11add3e705e43574e6b5cda53c052deb60597a2c2d6fe0ccfad9664b783dcf184e957ab8
SSDEEP

6144:UCInm8aZoWAKISUpNixlhrZ2jNt68BX7Rthra:UdmhC5KnUgDUBt7l7fh

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2404-7-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2472-15-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2604-83-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2472-187-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2472-2-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2404-7-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2404-6-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2472-15-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2604-81-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2604-83-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2472-187-0x0000000000400000-0x000000000046A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e418a310245c96fe86b85597177587e2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e418a310245c96fe86b85597177587e2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e418a310245c96fe86b85597177587e2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2404	2472	e418a310245c96fe86b85597177587e2_JaffaCakes118.exe	30
PID 2472 wrote to memory of 2404	2472	e418a310245c96fe86b85597177587e2_JaffaCakes118.exe	30
PID 2472 wrote to memory of 2404	2472	e418a310245c96fe86b85597177587e2_JaffaCakes118.exe	30
PID 2472 wrote to memory of 2404	2472	e418a310245c96fe86b85597177587e2_JaffaCakes118.exe	30
PID 2472 wrote to memory of 2604	2472	e418a310245c96fe86b85597177587e2_JaffaCakes118.exe	33
PID 2472 wrote to memory of 2604	2472	e418a310245c96fe86b85597177587e2_JaffaCakes118.exe	33
PID 2472 wrote to memory of 2604	2472	e418a310245c96fe86b85597177587e2_JaffaCakes118.exe	33
PID 2472 wrote to memory of 2604	2472	e418a310245c96fe86b85597177587e2_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\e418a310245c96fe86b85597177587e2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e418a310245c96fe86b85597177587e2_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Users\Admin\AppData\Local\Temp\e418a310245c96fe86b85597177587e2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e418a310245c96fe86b85597177587e2_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2404
- C:\Users\Admin\AppData\Local\Temp\e418a310245c96fe86b85597177587e2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e418a310245c96fe86b85597177587e2_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DCFE.57B

Filesize
1KB

MD5
7affd0fc0622a7a9c9c68fe423d6f952

SHA1
5e009ed945b6907f0708bd459da0627fee84d55b

SHA256
f1fab5ecf29351d795096a9ecc68f59478cfd9d5dc37ef462df7bceac083ea80

SHA512
6a1cd39bb15c9b7052eb15fc6c0b96e956a2bb99d4835ec278007c40693cb1dd8b8cb3bb1869d7b6873a48b0493897efea08d8248ed027f153929fa5f13700cd

Download Submit
C:\Users\Admin\AppData\Roaming\DCFE.57B

Filesize
600B

MD5
9211d254db47997d974afed1fa5c8053

SHA1
3c73fed6224f79e5a762767682eebaf92bbbe666

SHA256
0a14831cdf1e94bc120a457d898326755f29d454c3b1cb590306b4a6cac06525

SHA512
76c1914f6dad0a5af249ea2d1b4bed3ac6e0a2208c71916f3c4e46e47e50b4373433388939fb2167b046c6b38530c906bed207be6a167b9e8cae0a0fd914ec33

Download Submit
C:\Users\Admin\AppData\Roaming\DCFE.57B

Filesize
996B

MD5
62ce68ec6e43fb592ee3460a2d7bfa98

SHA1
fd8bd2504bc1220ab7dfdeb0fceca504a7f1cb12

SHA256
e51acd507c48ce75357ea64dc84935bc6b74d326fe823bb5791aed86c2574710

SHA512
a10da2f4f5285a0d82a422204fc11b68df7573772603a1a55553eaf41812066ac2422622427f7826cc5982d6af0b8745045271dcf05684c6f12eb0b18620c291

Download Submit
memory/2404-7-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2404-6-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2404-5-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2472-1-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2472-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2472-15-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2472-187-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2604-81-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2604-83-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing