cycbot | f6a8c08a4c28de5e906f052199e4391f111356f00bb230bebf87c03494f735bd

General

Target

f661db54f670a0d3cba8fc3c5fd37cad_JaffaCakes118.exe
Size

191KB
MD5

f661db54f670a0d3cba8fc3c5fd37cad
SHA1

f3da018ee06b903b1e68a6c5aad93686fdcfd17b
SHA256

f6a8c08a4c28de5e906f052199e4391f111356f00bb230bebf87c03494f735bd
SHA512

f8b0644bff7db28a68d8d81521ef986b73225294f07aa03eae605460208d0d8a3aea7aaf61ba139ec80a5542b095b2857b46ed253dc4fada72e80a582c187bfa
SSDEEP

3072:YSQ0TjdzACUj9ZV7IDGhChFUjwsDM62ImJdbd3e/2wIBQ2vzU/X+Lx:bfxdUJ8ChSFLsz27Jdbdf3EX

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2712-7-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot
behavioral1/memory/2120-15-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot
behavioral1/memory/584-85-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot
behavioral1/memory/2120-191-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2120-2-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2712-5-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2712-7-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2120-15-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/584-85-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2120-191-0x0000000000400000-0x0000000000469000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f661db54f670a0d3cba8fc3c5fd37cad_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f661db54f670a0d3cba8fc3c5fd37cad_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f661db54f670a0d3cba8fc3c5fd37cad_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2712	2120	f661db54f670a0d3cba8fc3c5fd37cad_JaffaCakes118.exe	30
PID 2120 wrote to memory of 2712	2120	f661db54f670a0d3cba8fc3c5fd37cad_JaffaCakes118.exe	30
PID 2120 wrote to memory of 2712	2120	f661db54f670a0d3cba8fc3c5fd37cad_JaffaCakes118.exe	30
PID 2120 wrote to memory of 2712	2120	f661db54f670a0d3cba8fc3c5fd37cad_JaffaCakes118.exe	30
PID 2120 wrote to memory of 584	2120	f661db54f670a0d3cba8fc3c5fd37cad_JaffaCakes118.exe	32
PID 2120 wrote to memory of 584	2120	f661db54f670a0d3cba8fc3c5fd37cad_JaffaCakes118.exe	32
PID 2120 wrote to memory of 584	2120	f661db54f670a0d3cba8fc3c5fd37cad_JaffaCakes118.exe	32
PID 2120 wrote to memory of 584	2120	f661db54f670a0d3cba8fc3c5fd37cad_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\f661db54f670a0d3cba8fc3c5fd37cad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f661db54f670a0d3cba8fc3c5fd37cad_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\f661db54f670a0d3cba8fc3c5fd37cad_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f661db54f670a0d3cba8fc3c5fd37cad_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2712
- C:\Users\Admin\AppData\Local\Temp\f661db54f670a0d3cba8fc3c5fd37cad_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f661db54f670a0d3cba8fc3c5fd37cad_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\2BFD.2E8

Filesize
1KB

MD5
cacf4e833206114fc9bcfb7c9e77edbd

SHA1
5836705f19d7ce69a6f05c1b5675fb087827af16

SHA256
da2b653bf39b7309de55c42f3cd8ffd0d43ae9b2ea118beed1a306830bb9e85a

SHA512
64cc68c45fdf21cfc179aedb1a13744dff671196d989a7570ea1e8676459e26993655236bd1747c7a1cc3770b69488f9930c57f66b91baf353e35ec25930eb55

Download Submit
C:\Users\Admin\AppData\Roaming\2BFD.2E8

Filesize
600B

MD5
37630e94e92327b9828d8456a38626f8

SHA1
5353fee78f094aae32eb948a9039a4e7657f9a5e

SHA256
90b7e297fe0d036d8e27fba24602eb068baa9188a85684255cf3551fcaf17647

SHA512
fc19a2ca9535e6c6f1dce1291665a9b7e72e0e32e2cba83af8e1f02f649a7b3cf7fcdd2cd44c2c8e0a1020c43c01b2955d0f1b1ca2ba21e57dcac961da720a41

Download Submit
C:\Users\Admin\AppData\Roaming\2BFD.2E8

Filesize
996B

MD5
2ae20d3ef1ef2a4d426b9a61ad8f27d1

SHA1
41154cbec3943bb9ddb0cee49557b1e939fafd34

SHA256
bfe8c99112a62a6a1fee33112d0aa8c8d7a5353682a5b0561860bd9ebfdfa5f9

SHA512
9a700668e60d802caf0ae966d5f07f1eb7c0e3f98859d60f928e64588333c4e3d675ea66c33366f75e6a54eeca7f2f4c4a0e33979f0164d6db141df5b130f176

Download Submit
memory/584-85-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2120-1-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2120-2-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2120-15-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2120-191-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2712-5-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2712-7-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download

Analysis

Sharing