cycbot | e8545f0d99dadfa454874d21839fb5b91d4fe5328d8d2b9c5a64a9a550d2135b

General

Target

e5e6c7c6b2fb5b8bc0e9d651e8244857_JaffaCakes118.exe
Size

186KB
MD5

e5e6c7c6b2fb5b8bc0e9d651e8244857
SHA1

053950de882c856df15ce17b06becae5c226b05b
SHA256

e8545f0d99dadfa454874d21839fb5b91d4fe5328d8d2b9c5a64a9a550d2135b
SHA512

562b7bbd36d6c34e50f7df55c2ba44286af6872721ad770a23fe11b7eefed4d6f40d6e5975aff28ca2eb35f3428bbeeafb71f528c4e13fbbc46415fe212ac74e
SSDEEP

3072:wMYVMAg7hCrqFduUoyag5Pykppwp8FqciW60GpkL7fsoNy:wDVnIg246b5ay28Fqco0GpknsoN

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2440-13-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/1824-14-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2664-70-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/1824-178-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1824-2-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2440-12-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2440-13-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1824-14-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2664-69-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2664-70-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1824-178-0x0000000000400000-0x000000000044E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5e6c7c6b2fb5b8bc0e9d651e8244857_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5e6c7c6b2fb5b8bc0e9d651e8244857_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5e6c7c6b2fb5b8bc0e9d651e8244857_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2440	1824	e5e6c7c6b2fb5b8bc0e9d651e8244857_JaffaCakes118.exe	28
PID 1824 wrote to memory of 2440	1824	e5e6c7c6b2fb5b8bc0e9d651e8244857_JaffaCakes118.exe	28
PID 1824 wrote to memory of 2440	1824	e5e6c7c6b2fb5b8bc0e9d651e8244857_JaffaCakes118.exe	28
PID 1824 wrote to memory of 2440	1824	e5e6c7c6b2fb5b8bc0e9d651e8244857_JaffaCakes118.exe	28
PID 1824 wrote to memory of 2664	1824	e5e6c7c6b2fb5b8bc0e9d651e8244857_JaffaCakes118.exe	30
PID 1824 wrote to memory of 2664	1824	e5e6c7c6b2fb5b8bc0e9d651e8244857_JaffaCakes118.exe	30
PID 1824 wrote to memory of 2664	1824	e5e6c7c6b2fb5b8bc0e9d651e8244857_JaffaCakes118.exe	30
PID 1824 wrote to memory of 2664	1824	e5e6c7c6b2fb5b8bc0e9d651e8244857_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\e5e6c7c6b2fb5b8bc0e9d651e8244857_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e5e6c7c6b2fb5b8bc0e9d651e8244857_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Users\Admin\AppData\Local\Temp\e5e6c7c6b2fb5b8bc0e9d651e8244857_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e5e6c7c6b2fb5b8bc0e9d651e8244857_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2440
- C:\Users\Admin\AppData\Local\Temp\e5e6c7c6b2fb5b8bc0e9d651e8244857_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e5e6c7c6b2fb5b8bc0e9d651e8244857_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\2E50.F45

Filesize
1KB

MD5
7ff3abf129a685aa4a8c9ed596e78054

SHA1
ac604773d0db9fe66812aa73cc82f7e8503f9daa

SHA256
ef3cd6008775200710bbd2b81e74e75dcc46e354d1308a772a105c86d72c1ae7

SHA512
260b5ca4c86f02efbe0dba489d058609878d4587b451569def169195d7fea6a34369cfa2147bafad5a20d38941afcab3613bf4cec074dfd1323d9c46c73c0e95

Download Submit
C:\Users\Admin\AppData\Roaming\2E50.F45

Filesize
600B

MD5
393ea8c3b64358cef5d9dac362f9b340

SHA1
2c7df1a5de6fd0bf7f2e25a78cf94560c3b418ab

SHA256
469072032cdc78b9994ebd58ea4714c1e609bd8c4eba7cfb4bebc8ad43139315

SHA512
e484f875b682abbcb5bc476e46d1dde41393190490f8fe58d337f6e28f5869dd628e6f1ee775a13a23200fed08947b6d2c3afb89a9aff32976922de01ebb844f

Download Submit
C:\Users\Admin\AppData\Roaming\2E50.F45

Filesize
996B

MD5
8da89ef6f07ba95a25b4c25167f13260

SHA1
93de787033cdac07b636572cef1ba09e8b83b6ca

SHA256
45837b5f2f7cd8c91b7dfb7cbf75bda2b2e6c519b5f36fd7e51b78c53f29e666

SHA512
60e70edf6cb9ffd8883d0abc0c1980b63a44f2c9677f1b21bfe64f8c99561bf15ef170b1e10c20c222a83e0c6a50b91000e11d4fb8663bfcaedfc213b615d2ea

Download Submit
memory/1824-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1824-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1824-14-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1824-178-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2440-12-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2440-13-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2664-69-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2664-70-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing