cycbot | 02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55

General

Target

f63d833c10db768188e7d27c6440f021_JaffaCakes118.exe
Size

194KB
MD5

f63d833c10db768188e7d27c6440f021
SHA1

3dd44f62b6851518eb44008810f31f41efd715f6
SHA256

02453b088c4789a664a7c5deea78e455d8d8681c266d58a569120d70cf7b9e55
SHA512

e1d72af631620fd583146df64fce5b0df0bd8dbc39a498a29c669e210a902dd5cc5f47454142609845ef595dff5adeba85aff7b1d59fd3c3929e1ca9961fe585
SSDEEP

3072:5aIAIURcG02hGZ3yMAx4AvS/1JjU+hGGhVTOEPttEvuMu8asuiUh/b49neFiFaoB:5mTRx0z3yMQDS/XjzYi/lkBN7JCDZ4t

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2324-6-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2980-14-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2580-76-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2580-78-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2980-185-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process
PID 2980 set thread context of 0	2980	f63d833c10db768188e7d27c6440f021_JaffaCakes118.exe
PID 2324 set thread context of 0	2324	f63d833c10db768188e7d27c6440f021_JaffaCakes118.exe
PID 2580 set thread context of 0	2580	f63d833c10db768188e7d27c6440f021_JaffaCakes118.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2980-2-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2324-6-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2980-14-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2580-76-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2580-78-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2980-185-0x0000000000400000-0x000000000046A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f63d833c10db768188e7d27c6440f021_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f63d833c10db768188e7d27c6440f021_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f63d833c10db768188e7d27c6440f021_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2324	2980	f63d833c10db768188e7d27c6440f021_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2324	2980	f63d833c10db768188e7d27c6440f021_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2324	2980	f63d833c10db768188e7d27c6440f021_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2324	2980	f63d833c10db768188e7d27c6440f021_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2580	2980	f63d833c10db768188e7d27c6440f021_JaffaCakes118.exe	33
PID 2980 wrote to memory of 2580	2980	f63d833c10db768188e7d27c6440f021_JaffaCakes118.exe	33
PID 2980 wrote to memory of 2580	2980	f63d833c10db768188e7d27c6440f021_JaffaCakes118.exe	33
PID 2980 wrote to memory of 2580	2980	f63d833c10db768188e7d27c6440f021_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\f63d833c10db768188e7d27c6440f021_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f63d833c10db768188e7d27c6440f021_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\f63d833c10db768188e7d27c6440f021_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f63d833c10db768188e7d27c6440f021_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:2324
- C:\Users\Admin\AppData\Local\Temp\f63d833c10db768188e7d27c6440f021_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f63d833c10db768188e7d27c6440f021_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\CB73.5A0

Filesize
1KB

MD5
1aa45f99b2e3510fb433fb3183479a7c

SHA1
280ca0766f380aa5f3ceeefd2185981f2d6d2968

SHA256
79945254a1defe1b646af23aafa67a8e59b6d7b838ac5bdf12370981b3211794

SHA512
d8b03b47798fb29e05ef43789c62433c9371cc7ff674f1b42971834b6e93ba93a02ad2b1c29328279d84eccf1f7f7b43567fe28ad2f839fb0a7e9d846d928998

Download Submit
C:\Users\Admin\AppData\Roaming\CB73.5A0

Filesize
600B

MD5
0dba0255af1655ca98770ca696c6c625

SHA1
e5ae47c79a8a1a0a8d22eab3a85e253b7af0fd16

SHA256
5b84325ac8c66f121d358233ab3650cf0de5657661119c7a8a5866e1903ee38c

SHA512
c6b9bd740d392d9acbde54e75d0c9f4d6cc5296f0438720016842296b9931c2a79e84a3f914caa2ec5306fea88688b3fe55b15ca0726f4c87dd8bd2705885e57

Download Submit
memory/2324-6-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2580-76-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2580-78-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2980-1-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2980-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2980-14-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2980-185-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing