cycbot | 92ee5c4f1bb695c4f2cb757fe035619c631cbcd9bb4527377fa24028cb32f6c3

General

Target

e811f46d6d3d7626760314069f27386c_JaffaCakes118.exe
Size

170KB
MD5

e811f46d6d3d7626760314069f27386c
SHA1

b2819364c0b8428df87f3acdb473fada9ddbdcf1
SHA256

92ee5c4f1bb695c4f2cb757fe035619c631cbcd9bb4527377fa24028cb32f6c3
SHA512

b7ef809ab43f4593fd2b93497fe3655f25b8e6beedfa964ec550d1be11de24b6d683d9eee46604179180cb821cee84589f70446c31d775c8d8525a316f83bd5f
SSDEEP

3072:srsxR5GmMgjNvn0COV/89SPk81uRRzA23uRn43szMaoAn:sAxR4/qNv0FtmzRzAYXsLVn

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2916-7-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/2112-15-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/2564-70-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/2112-187-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2112-2-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2916-5-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2916-7-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2112-15-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2564-70-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2112-187-0x0000000000400000-0x000000000044B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e811f46d6d3d7626760314069f27386c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e811f46d6d3d7626760314069f27386c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e811f46d6d3d7626760314069f27386c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2916	2112	e811f46d6d3d7626760314069f27386c_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2916	2112	e811f46d6d3d7626760314069f27386c_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2916	2112	e811f46d6d3d7626760314069f27386c_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2916	2112	e811f46d6d3d7626760314069f27386c_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2564	2112	e811f46d6d3d7626760314069f27386c_JaffaCakes118.exe	33
PID 2112 wrote to memory of 2564	2112	e811f46d6d3d7626760314069f27386c_JaffaCakes118.exe	33
PID 2112 wrote to memory of 2564	2112	e811f46d6d3d7626760314069f27386c_JaffaCakes118.exe	33
PID 2112 wrote to memory of 2564	2112	e811f46d6d3d7626760314069f27386c_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\e811f46d6d3d7626760314069f27386c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e811f46d6d3d7626760314069f27386c_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\e811f46d6d3d7626760314069f27386c_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e811f46d6d3d7626760314069f27386c_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2916
- C:\Users\Admin\AppData\Local\Temp\e811f46d6d3d7626760314069f27386c_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e811f46d6d3d7626760314069f27386c_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\4BA2.C6A

Filesize
600B

MD5
59f38f068325f3b1233fbd77c7fe3a5d

SHA1
660a7a59f46fb2f3c315717871a0096215de2f54

SHA256
7b4c9f3a7f2f88b589020e0d365eeb6279365b51d97fdd0e26d47c143aa1a13f

SHA512
85fe80d3b8d50a7429c6aa209a8371539102e49cad90f9315526029a825bd8bcf2e5a38c4a586b5f447b0be8d65196eca45b5ccab1c3035566778ba8ba2b477c

Download Submit
C:\Users\Admin\AppData\Roaming\4BA2.C6A

Filesize
1KB

MD5
02ce169ff729741a0815134fa7f63284

SHA1
4ff658502947c3838f1a27f5232a7f3a06f97d92

SHA256
b43d9c18ef5b8267bd79bcea0e6b9a85a29b89f3f0caf4fa32d508d2f69c7dce

SHA512
1af72f4a3efdbf686482cb5744227cb56a934e073388e8def5e685949eb75d50a818a081f85389060525a1102f59412ea6aacd588836a90362ccdfbca1547f83

Download Submit
C:\Users\Admin\AppData\Roaming\4BA2.C6A

Filesize
996B

MD5
cf6dffb89b8ea8ba071a1f85beaecb78

SHA1
fdbf28768c6f1ae267559f5a99eaf0ca39077ad8

SHA256
c2dba2a7c8d243953a8748a366a1833f4685d982ceda02a70d42d2be634547e7

SHA512
9584704748ccaff107bcb969ebdcdc1fd8cb27e983feb6a8afa65ff29ae2ef8caa80903acde68002f21f28011c28a3c993ebbcc1db1de685191882eaa51b9a53

Download Submit
memory/2112-1-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2112-2-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2112-15-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2112-187-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2564-70-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2916-5-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2916-7-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download

Analysis

Sharing