cycbot | 67ee9ec147c8b9f26af0b0b992d20a4f75d1856b9378f67015085dd03d8d2c2f

General

Target

f5ea747b59f5a47ee3b1c5304271e33b_JaffaCakes118.exe
Size

182KB
MD5

f5ea747b59f5a47ee3b1c5304271e33b
SHA1

62f8c204d039daea9b1c36a1b670eb087aa8836f
SHA256

67ee9ec147c8b9f26af0b0b992d20a4f75d1856b9378f67015085dd03d8d2c2f
SHA512

cff7346f5ee549685a84cd347e04aad0b1948d8a8372f1bb922b83f7a7124c9b51f12c8b2161496137d077dc269221f1b6708b69e0ae6bcd0ebb1d150412bf38
SSDEEP

3072:+tRsWUUljM0H76m9osI/DUjLSf8GSHZ9ONQZEnZ0uWL1X/sWQoMoMwyIIWceWjUP:+bsGlY06mGsIUG8BHzOaZ4paXJQRz9r2

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2524-7-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1236-15-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2176-84-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1236-195-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1236-2-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2524-5-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2524-7-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1236-15-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2176-84-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1236-195-0x0000000000400000-0x000000000046A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5ea747b59f5a47ee3b1c5304271e33b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5ea747b59f5a47ee3b1c5304271e33b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5ea747b59f5a47ee3b1c5304271e33b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 2524	1236	f5ea747b59f5a47ee3b1c5304271e33b_JaffaCakes118.exe	29
PID 1236 wrote to memory of 2524	1236	f5ea747b59f5a47ee3b1c5304271e33b_JaffaCakes118.exe	29
PID 1236 wrote to memory of 2524	1236	f5ea747b59f5a47ee3b1c5304271e33b_JaffaCakes118.exe	29
PID 1236 wrote to memory of 2524	1236	f5ea747b59f5a47ee3b1c5304271e33b_JaffaCakes118.exe	29
PID 1236 wrote to memory of 2176	1236	f5ea747b59f5a47ee3b1c5304271e33b_JaffaCakes118.exe	31
PID 1236 wrote to memory of 2176	1236	f5ea747b59f5a47ee3b1c5304271e33b_JaffaCakes118.exe	31
PID 1236 wrote to memory of 2176	1236	f5ea747b59f5a47ee3b1c5304271e33b_JaffaCakes118.exe	31
PID 1236 wrote to memory of 2176	1236	f5ea747b59f5a47ee3b1c5304271e33b_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\f5ea747b59f5a47ee3b1c5304271e33b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5ea747b59f5a47ee3b1c5304271e33b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Local\Temp\f5ea747b59f5a47ee3b1c5304271e33b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f5ea747b59f5a47ee3b1c5304271e33b_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2524
- C:\Users\Admin\AppData\Local\Temp\f5ea747b59f5a47ee3b1c5304271e33b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f5ea747b59f5a47ee3b1c5304271e33b_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\91C6.14C

Filesize
1KB

MD5
aa6b71ba53694fa64ae7ef0d4d8927f3

SHA1
cac08969a9a88e3e298418ee9d43a9eca9b32adb

SHA256
31f1d6ef4dd88034c06066288e25a9f116a0f580702ae8ae733ca5a594a89884

SHA512
2fe551718065e7badee8164e973518abf541c7cd87d514c66d67fbf6069f6b41afec74c60ec0d4d2a01b86986adde26d5bdd442e26ec1a4eb6adaea3dd82f1ac

Download Submit
C:\Users\Admin\AppData\Roaming\91C6.14C

Filesize
600B

MD5
e20537de17e2e797709eb9c694be6f86

SHA1
3dad70f70eeae3f049d167b8d7e23418b110db92

SHA256
b3969bb86bcdb9088398c84f23ebb316f01c16dae6bfe00385e7ba425ec47854

SHA512
d23c2c3143fcc046e6b3dfb7c8545c4ed4ae06f0ba248803791f02007089900c30bbc75450f48d79c397451d18ae60f4a3f9a02002af099b3a753fc3c22e64ca

Download Submit
C:\Users\Admin\AppData\Roaming\91C6.14C

Filesize
996B

MD5
4bc48086aa5302e07f02e4c9d95da10c

SHA1
1b21fbf11bfe5b71cf6854124f2179d65b2cca65

SHA256
5bb174bbfffa38a41c8f520427e6f3d71fe2294b3c6ba2f5a1de1fd81191e475

SHA512
8fb97661132926068403e647d97fe7e8a0e5e51bc9f002fa7872d34d9a941c3cfb7a98c20b28737d5cd3a2ac933bf0a06b023445edc80b24f2162c534a8e7a2d

Download Submit
memory/1236-1-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1236-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1236-15-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1236-195-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2176-84-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2176-82-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2524-5-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2524-7-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing