cycbot | b2342931a413fadbc60bcd00d9add49bebbf147ab3bb305a80d8eb6169d549f4

General

Target

e77b16918e4c32f4d8fdd1fce0a33b65_JaffaCakes118.exe
Size

178KB
MD5

e77b16918e4c32f4d8fdd1fce0a33b65
SHA1

9a5c501771ceb7219a9885a9890f48865603d2a4
SHA256

b2342931a413fadbc60bcd00d9add49bebbf147ab3bb305a80d8eb6169d549f4
SHA512

d11a6501bc583d74c7439a962b2f561e5103ba2f0f38e6edb88a16b7608cbbc356c050a57a33cbea0e7eb89539849d86f3b1bc111afc1ddcc27d9bf2a24f63dd
SSDEEP

3072:pajLOPuOHlI1DN/+VNJCZIkmI7CEJgDbovVbg+bDSd:wjiPupDN/YCWkVCDotU1d

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/2676-8-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/380-9-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/380-10-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral2/memory/4652-75-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/380-176-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/380-2-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2676-8-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/380-9-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/380-10-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/4652-75-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/380-176-0x0000000000400000-0x0000000000455000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e77b16918e4c32f4d8fdd1fce0a33b65_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e77b16918e4c32f4d8fdd1fce0a33b65_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e77b16918e4c32f4d8fdd1fce0a33b65_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 2676	380	e77b16918e4c32f4d8fdd1fce0a33b65_JaffaCakes118.exe	84
PID 380 wrote to memory of 2676	380	e77b16918e4c32f4d8fdd1fce0a33b65_JaffaCakes118.exe	84
PID 380 wrote to memory of 2676	380	e77b16918e4c32f4d8fdd1fce0a33b65_JaffaCakes118.exe	84
PID 380 wrote to memory of 4652	380	e77b16918e4c32f4d8fdd1fce0a33b65_JaffaCakes118.exe	98
PID 380 wrote to memory of 4652	380	e77b16918e4c32f4d8fdd1fce0a33b65_JaffaCakes118.exe	98
PID 380 wrote to memory of 4652	380	e77b16918e4c32f4d8fdd1fce0a33b65_JaffaCakes118.exe	98

C:\Users\Admin\AppData\Local\Temp\e77b16918e4c32f4d8fdd1fce0a33b65_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e77b16918e4c32f4d8fdd1fce0a33b65_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:380
- C:\Users\Admin\AppData\Local\Temp\e77b16918e4c32f4d8fdd1fce0a33b65_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e77b16918e4c32f4d8fdd1fce0a33b65_JaffaCakes118.exe startC:\Program Files (x86)\LP\C1B6\7B5.exe%C:\Program Files (x86)\LP\C1B6
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2676
- C:\Users\Admin\AppData\Local\Temp\e77b16918e4c32f4d8fdd1fce0a33b65_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e77b16918e4c32f4d8fdd1fce0a33b65_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\6C187\6E6C1.exe%C:\Users\Admin\AppData\Roaming\6C187
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\6C187\7EA2.C18

Filesize
300B

MD5
85bbc9cd9815f00c4b1b47726bf4afc9

SHA1
4e3a0e4684044998a85610b7a9be0a27a4c4bea0

SHA256
a5bc48ed5f6d53a7f18c580d3890927884e5abad1b5570a472573b95c030f0eb

SHA512
100a7002ed088468b8a8aeb0a41c7661db24b238e2901a7c74cb7068d1c6e87d7669fc2212c44db353c94959303767d869921df589a00c0fd0ddf2b0b452bf9b

Download Submit
C:\Users\Admin\AppData\Roaming\6C187\7EA2.C18

Filesize
1KB

MD5
148e10746f7c29e5fc484150e341de31

SHA1
738a005e243da4c5caf7becc294416d3981b24de

SHA256
92c745cde1ee4f3e718348326c6eea14597ce58593699b85a124d1c4867176a3

SHA512
67bc0e62dfed31c212e56d88dc035dea4cd053d399c66cc277bd7965eeb51e29e049189356b0773becf395a60c048aecb5f9ed0bc5390b056fc2c6c48691b8e2

Download Submit
C:\Users\Admin\AppData\Roaming\6C187\7EA2.C18

Filesize
696B

MD5
a740fe22ef283190caf58a1d105c3cbd

SHA1
1280deaaff41b5aeb9ec0fe7f27d4c6a6904ac1e

SHA256
e142a9adb14352dc4c0f3556a4a5059679970cf2d77c61749c6ea060bae67f89

SHA512
d9b413c2c87a2fd71b08ee36a2835abeb0a579471988beb0147be0f8fd34868f9a5e5bb5793de3a248498b02a8e8d60831a0ffd5540bf577f1cb73432420cd3d

Download Submit
memory/380-1-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/380-2-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/380-9-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/380-10-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/380-176-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2676-7-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2676-8-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4652-75-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing