cycbot | ce660a97d153a446018a997dcc8ccb2b69a12d2d65f47315ad3ca489402fb0da

General

Target

f5c36f0891a6317732aac5f91f6fc5b3_JaffaCakes118.exe
Size

183KB
MD5

f5c36f0891a6317732aac5f91f6fc5b3
SHA1

b0e5444d865c0cc3c8d582f5c3ceb830115d9718
SHA256

ce660a97d153a446018a997dcc8ccb2b69a12d2d65f47315ad3ca489402fb0da
SHA512

27fa64479ba5079cd54525d765ae0feaf215e8be35dc8ed07a7cef320e2e8d0944e22dbaa010ee3fafb5d53538bed7209bc7a5a9b6732c427ddb7e5fe7ed9a08
SSDEEP

3072:2SABN3qhIHfCqww/XWChNNawTG5gcOB/YkLNLRL9yBT7eMaqnW/AwhM5i:2SAL3qOTj/GoLamxtpRL2WGnWY9i

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/668-13-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral2/memory/1468-14-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral2/memory/3120-79-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral2/memory/1468-192-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1468-1-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/1468-2-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/668-13-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/1468-14-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/3120-79-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/1468-192-0x0000000000400000-0x000000000044E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5c36f0891a6317732aac5f91f6fc5b3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5c36f0891a6317732aac5f91f6fc5b3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5c36f0891a6317732aac5f91f6fc5b3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 668	1468	f5c36f0891a6317732aac5f91f6fc5b3_JaffaCakes118.exe	83
PID 1468 wrote to memory of 668	1468	f5c36f0891a6317732aac5f91f6fc5b3_JaffaCakes118.exe	83
PID 1468 wrote to memory of 668	1468	f5c36f0891a6317732aac5f91f6fc5b3_JaffaCakes118.exe	83
PID 1468 wrote to memory of 3120	1468	f5c36f0891a6317732aac5f91f6fc5b3_JaffaCakes118.exe	85
PID 1468 wrote to memory of 3120	1468	f5c36f0891a6317732aac5f91f6fc5b3_JaffaCakes118.exe	85
PID 1468 wrote to memory of 3120	1468	f5c36f0891a6317732aac5f91f6fc5b3_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\f5c36f0891a6317732aac5f91f6fc5b3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5c36f0891a6317732aac5f91f6fc5b3_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Users\Admin\AppData\Local\Temp\f5c36f0891a6317732aac5f91f6fc5b3_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f5c36f0891a6317732aac5f91f6fc5b3_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:668
- C:\Users\Admin\AppData\Local\Temp\f5c36f0891a6317732aac5f91f6fc5b3_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f5c36f0891a6317732aac5f91f6fc5b3_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\3648.357

Filesize
1KB

MD5
b33fd5e00c627b2d7875f82f2c66fd02

SHA1
c3909d7001115fbad534b16fcf9a3859b89710bd

SHA256
e8fb6fc960704442ee7a2d530b54df97bc259405f01cdca67f9b1e1698793f70

SHA512
8d28eb3adcd27d01f8fc54c0f6a0bf00da7078e2d19b5373eadb67302fdacbf105458c46693c21a16801b96dd52174918ae51579cf9ff999f22bcdad805cbafe

Download Submit
C:\Users\Admin\AppData\Roaming\3648.357

Filesize
600B

MD5
ca745df63e72de168cbf51fcab8118c8

SHA1
d6b988ecce24e657edc981caa1f570cb8128879d

SHA256
5bfbd56d19719af94a6275ab5df8fb72659e548563ecd79dcc01973d1e62e3c0

SHA512
386c0506c521c5840817e5b850e253193e709ed06d3dd2f549bf9b89b90a737370319113186f7e8191a184570298f6ec82e48a3a3f92e35a8fbef5a6917fd353

Download Submit
C:\Users\Admin\AppData\Roaming\3648.357

Filesize
996B

MD5
bf0351dd8aed618fdb46ac8d9afb1505

SHA1
46471144ebeac50bd120ef0403f9c42015c8a38b

SHA256
2922f8db83330b0b626ad3811f97045911cc2ec2e64b89fb4fe06c57a3546a1f

SHA512
20283535b0a98449f3aefd3ff49c7933785662d3dd4dc603c5d7c596f0038c2a0d848c28264c5e2d0053b21f907250c607d58291185bdfbe616ff0ed98ee7f11

Download Submit
memory/668-13-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1468-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1468-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1468-14-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1468-192-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3120-77-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3120-79-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing