cycbot | b0ad2e18b6a3b9777129b900fe5874b579394cb9ff51e135046bdb7a6cdf0371

General

Target

eb0e9117b5ef0c574803770b0b36f844_JaffaCakes118.exe
Size

161KB
MD5

eb0e9117b5ef0c574803770b0b36f844
SHA1

030f3767cd4322f045f26c5cd6e14c0bc7d54fcb
SHA256

b0ad2e18b6a3b9777129b900fe5874b579394cb9ff51e135046bdb7a6cdf0371
SHA512

adc33c4cbea0961c9a382c53ec49f744c1c5ed298e7bb7e87ae94caf31597a610c93a6b07da75f7d7fc3f78a42b07e2e6fb2eed1025acd05374798fb76029734
SSDEEP

3072:kojx9B/pFtWUL2bICrLBT48/KQ3gr81sRUTYa0BkZg9EzpAdSuPY32nVutG1lZNv:koV9B/pFtWi2bICrLBs8/KQK/ZzkWezm

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2740-7-0x0000000000400000-0x0000000000468000-memory.dmp	family_cycbot
behavioral1/memory/2964-15-0x0000000000400000-0x0000000000468000-memory.dmp	family_cycbot
behavioral1/memory/2188-87-0x0000000000400000-0x0000000000468000-memory.dmp	family_cycbot
behavioral1/memory/2964-190-0x0000000000400000-0x0000000000468000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2964-2-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/2740-7-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/2740-6-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/2740-5-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/2964-15-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/2188-86-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/2188-87-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/2964-190-0x0000000000400000-0x0000000000468000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb0e9117b5ef0c574803770b0b36f844_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb0e9117b5ef0c574803770b0b36f844_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb0e9117b5ef0c574803770b0b36f844_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2740	2964	eb0e9117b5ef0c574803770b0b36f844_JaffaCakes118.exe	30
PID 2964 wrote to memory of 2740	2964	eb0e9117b5ef0c574803770b0b36f844_JaffaCakes118.exe	30
PID 2964 wrote to memory of 2740	2964	eb0e9117b5ef0c574803770b0b36f844_JaffaCakes118.exe	30
PID 2964 wrote to memory of 2740	2964	eb0e9117b5ef0c574803770b0b36f844_JaffaCakes118.exe	30
PID 2964 wrote to memory of 2188	2964	eb0e9117b5ef0c574803770b0b36f844_JaffaCakes118.exe	32
PID 2964 wrote to memory of 2188	2964	eb0e9117b5ef0c574803770b0b36f844_JaffaCakes118.exe	32
PID 2964 wrote to memory of 2188	2964	eb0e9117b5ef0c574803770b0b36f844_JaffaCakes118.exe	32
PID 2964 wrote to memory of 2188	2964	eb0e9117b5ef0c574803770b0b36f844_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\eb0e9117b5ef0c574803770b0b36f844_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb0e9117b5ef0c574803770b0b36f844_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\eb0e9117b5ef0c574803770b0b36f844_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\eb0e9117b5ef0c574803770b0b36f844_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2740
- C:\Users\Admin\AppData\Local\Temp\eb0e9117b5ef0c574803770b0b36f844_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\eb0e9117b5ef0c574803770b0b36f844_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\26CB.908

Filesize
1KB

MD5
660638163bc2420b83ded86014ffdc36

SHA1
33f3228e0cc9d61797af8b75334385326f83f149

SHA256
8d0b65967bce8b7b8e2c1863e8dfba0bf7ff1fce84c1845e75be5f87ccc3ef99

SHA512
7b7864b2d814a8bade7238ccfb8ecf735542a4353af8533cbc53d98f800e514dcb217787b2dbb8ef4b4d178cdd697e7f549f7217f5a0ba79a261e3bf186ca225

Download Submit
C:\Users\Admin\AppData\Roaming\26CB.908

Filesize
600B

MD5
02c365d53e12ded3116933e94f6e5cc9

SHA1
65c0908d083e1bd5154e5584dd7ee0b8cfb3cf30

SHA256
1a9430b10c0955122d5a0b1609384811a55b2371ad209d4afe9af645b2cb76ed

SHA512
8c6c8d18539f0efab5222e83442fc28f6470efba9898f1c5db3226ed882f8b0ac1bb9e753455595ced1e82fd3d1b77d500e80f1ebafed2b17e8a6d8c2a3f04d9

Download Submit
C:\Users\Admin\AppData\Roaming\26CB.908

Filesize
996B

MD5
0a917666fccf9ff261e8154e5bf3ca04

SHA1
bcb9eefe27d4fcdbeaa940edf96298f5366bb76d

SHA256
cc8dc6d7b7b9945d506dc1a55b6deb9cadcef85179cec52675752499bbe1a678

SHA512
83a4d215b628f005434f7d710dabc5c6a12bd660f06736084508889cccb80e37bdd15cc9e3e4c57a3bb8d85ccae32b38f0d2fdfdaaa2714c09c6e5df22bf6142

Download Submit
memory/2188-86-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2188-87-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2740-7-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2740-6-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2740-5-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2964-1-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2964-2-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2964-15-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2964-190-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing