cycbot | ba01d0bc21857a70b3871bba9248508357342b1f05c25e3b02201c2a5d7fac99

General

Target

e43bfbdaf98a56bafaa9a2335f4f5308_JaffaCakes118.exe
Size

176KB
MD5

e43bfbdaf98a56bafaa9a2335f4f5308
SHA1

c311ec51e5ce9c89294fe9b7a670cc7209e8d104
SHA256

ba01d0bc21857a70b3871bba9248508357342b1f05c25e3b02201c2a5d7fac99
SHA512

a33501a29e38a75e543e3e05753ac7e78385f0aed610a608d9fe09732b986e887bc47d7b71e54f567ec60da1583d869c99821ffc51f1054ec94cabcfc2c2aed1
SSDEEP

3072:H6NJ7am8oFpXqNz4ozeL8UoizcoDh9oPQY3VzyAXmKLdiGsy5VQs3:aqoFpw2tcRtBzXmKj

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1264-18-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/2372-20-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/2740-84-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/2372-182-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2372-2-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/1264-18-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2372-20-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2740-83-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2740-84-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2372-182-0x0000000000400000-0x000000000046B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e43bfbdaf98a56bafaa9a2335f4f5308_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e43bfbdaf98a56bafaa9a2335f4f5308_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e43bfbdaf98a56bafaa9a2335f4f5308_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1264	2372	e43bfbdaf98a56bafaa9a2335f4f5308_JaffaCakes118.exe	30
PID 2372 wrote to memory of 1264	2372	e43bfbdaf98a56bafaa9a2335f4f5308_JaffaCakes118.exe	30
PID 2372 wrote to memory of 1264	2372	e43bfbdaf98a56bafaa9a2335f4f5308_JaffaCakes118.exe	30
PID 2372 wrote to memory of 1264	2372	e43bfbdaf98a56bafaa9a2335f4f5308_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2740	2372	e43bfbdaf98a56bafaa9a2335f4f5308_JaffaCakes118.exe	33
PID 2372 wrote to memory of 2740	2372	e43bfbdaf98a56bafaa9a2335f4f5308_JaffaCakes118.exe	33
PID 2372 wrote to memory of 2740	2372	e43bfbdaf98a56bafaa9a2335f4f5308_JaffaCakes118.exe	33
PID 2372 wrote to memory of 2740	2372	e43bfbdaf98a56bafaa9a2335f4f5308_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\e43bfbdaf98a56bafaa9a2335f4f5308_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e43bfbdaf98a56bafaa9a2335f4f5308_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\e43bfbdaf98a56bafaa9a2335f4f5308_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e43bfbdaf98a56bafaa9a2335f4f5308_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1264
- C:\Users\Admin\AppData\Local\Temp\e43bfbdaf98a56bafaa9a2335f4f5308_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e43bfbdaf98a56bafaa9a2335f4f5308_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\F9B3.7BF

Filesize
1KB

MD5
a72dcc6c471ed578f1d6d75aa6cf1ccf

SHA1
bd61636ff53f192c3def31bcb201b481fe2bff75

SHA256
41292314304b0d0e687e21291958f2113a9460a375eb0300684a0d6de88ca7a7

SHA512
722a0fe64a4f5458e7f561df514d0758ffef2f4992dc63d393247c26cc7347425e9bb5b8cf86f03c6a5cfa73f9164e5e59d0839844228a04daf878bfb5609647

Download Submit
C:\Users\Admin\AppData\Roaming\F9B3.7BF

Filesize
897B

MD5
f33b972e59c3e234c465498237327e4c

SHA1
b3c16acdce79b5f330e536ab1c0c7f607df7fd5d

SHA256
b47faed08b761d0b696e25e7c3d8c92882425d77db5518903b79b400915b2ff0

SHA512
b9e2e8628b0e88f184ba02c422d110a47d4adfd87b68ff2276919ec08f6bb2099f089ca2b777d074ac1280f0dc496df1d53335c7bd8e2c31d3fe6b0e954b1701

Download Submit
C:\Users\Admin\AppData\Roaming\F9B3.7BF

Filesize
1KB

MD5
01d8c02be1d0c6fb2fcd8560d502788b

SHA1
183949d54cee76501dce7cb515d3b2e79a6eef5c

SHA256
867c7e4788202c4efa0b5e2020a9df14f41ae0b94196498ac3ac052bdae959d1

SHA512
ae746767c5dfac3cba58f2abda3fab704b0543874fa9a73ebf4f92fc25884bc5cc001fe16c2144709ad1ba1826fe1444ea4f576a39df6433a643a5cc8afcad1c

Download Submit
C:\Users\Admin\AppData\Roaming\F9B3.7BF

Filesize
597B

MD5
f6ac0492b1ef1161a4e344c07cac283a

SHA1
38ccbe07b7f361d86b6e7dd523944ac32f1d1688

SHA256
a3ccca2db66e5432bee92ef4cbfda9ae3ee20550d2fe41538178d9d649220f24

SHA512
07a1f9a20158d9655e9a1f791e6da8795f951430b095cf9119f5277715d7f174062bff96a0e7ca85addaa6c64e3b4bb2d2ae1b6e270b8d8d81795f050d1cb6b9

Download Submit
memory/1264-17-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1264-18-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2372-1-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2372-2-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2372-20-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2372-182-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2740-83-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2740-84-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing