cycbot | c30c371b4e0da20983670e2452290af8426f220458be9cf9480c99fada6d4d63

General

Target

f6bf395b1f55d3eccc3b732027df00df_JaffaCakes118.exe
Size

162KB
MD5

f6bf395b1f55d3eccc3b732027df00df
SHA1

f8ec0394db9282513356c35d47b69d34cdee36e7
SHA256

c30c371b4e0da20983670e2452290af8426f220458be9cf9480c99fada6d4d63
SHA512

0eee87379c5bfe26e00e1c1aa4094261746e4129775be56a990d40fc42114306e78ed0c9155bd11ec8c7a6529e2231b8a2c1d8c6d8658031aaee03488316308f
SSDEEP

3072:LMODL73WjsA8tN+1SBUUFmb3dljc7ZvizLKuUpPb25ZCiMUslLAH0TjRd3yeCo:oYL7GjNH1SZUzzw1+KZpi5bMoUTjXGo

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2416-9-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot
behavioral1/memory/2360-20-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot
behavioral1/memory/2004-88-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot
behavioral1/memory/2360-200-0x0000000000400000-0x0000000000469000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2360-2-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2416-9-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2416-7-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2360-20-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2004-86-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2004-88-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2360-200-0x0000000000400000-0x0000000000469000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6bf395b1f55d3eccc3b732027df00df_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6bf395b1f55d3eccc3b732027df00df_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6bf395b1f55d3eccc3b732027df00df_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2416	2360	f6bf395b1f55d3eccc3b732027df00df_JaffaCakes118.exe	30
PID 2360 wrote to memory of 2416	2360	f6bf395b1f55d3eccc3b732027df00df_JaffaCakes118.exe	30
PID 2360 wrote to memory of 2416	2360	f6bf395b1f55d3eccc3b732027df00df_JaffaCakes118.exe	30
PID 2360 wrote to memory of 2416	2360	f6bf395b1f55d3eccc3b732027df00df_JaffaCakes118.exe	30
PID 2360 wrote to memory of 2004	2360	f6bf395b1f55d3eccc3b732027df00df_JaffaCakes118.exe	32
PID 2360 wrote to memory of 2004	2360	f6bf395b1f55d3eccc3b732027df00df_JaffaCakes118.exe	32
PID 2360 wrote to memory of 2004	2360	f6bf395b1f55d3eccc3b732027df00df_JaffaCakes118.exe	32
PID 2360 wrote to memory of 2004	2360	f6bf395b1f55d3eccc3b732027df00df_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\f6bf395b1f55d3eccc3b732027df00df_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6bf395b1f55d3eccc3b732027df00df_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\f6bf395b1f55d3eccc3b732027df00df_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f6bf395b1f55d3eccc3b732027df00df_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2416
- C:\Users\Admin\AppData\Local\Temp\f6bf395b1f55d3eccc3b732027df00df_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f6bf395b1f55d3eccc3b732027df00df_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\7C0D.CC8

Filesize
597B

MD5
297fe91458fdf95a00fcbaa2c7746242

SHA1
d2fa08f664d8c9ff34e92924adcfdbeee4acc3bd

SHA256
03016e8c92bcaf94b376420d06a4314fad2947166cf4b93725d46c76cb5cf4ee

SHA512
bd9d45d2f2002c9ec07b746275cc760f4bf6daa9b6e32ac5c513bb2074cbbacf55492082f971ac9e3c27f321d2c60d3c53b0f8cf7bf6a496c4107923ee44550d

Download Submit
C:\Users\Admin\AppData\Roaming\7C0D.CC8

Filesize
1KB

MD5
341d2f6be1d537237c91905634d45e7c

SHA1
b8a484f60018e9236e4e8c8d022cc2c4662f8f7d

SHA256
3f8d7194368025be2bb9df6e915d08f6af0af7f1fc5e576078e3e141b5fcd819

SHA512
1c524c4c75d885e3bdf96627ebc951c25c40378a473db8e25885e5c5c880ab9506acc65a086130da317c5e6e44a63b3eb5657f6976b784fee66f732b8d62753a

Download Submit
C:\Users\Admin\AppData\Roaming\7C0D.CC8

Filesize
897B

MD5
feb7652e03ea5fb1eb2086c0860112b7

SHA1
64c9522abc7e12c016b76ff502651d6bfbb51530

SHA256
5a01ad98572b8665ea2da60285e537f036e6bf6d749ad96f89bafc00784d4a63

SHA512
654728949e126ee0dcaddc42273d5876fdb135a293c212d016edf3823fd8aa2cd03c6acf63a75e8024dd376ff513297ceb6c758e0291c846dedeffa62b94f514

Download Submit
C:\Users\Admin\AppData\Roaming\7C0D.CC8

Filesize
1KB

MD5
a0e01867d50032798c21f5fc211712b7

SHA1
a04377e0fe61f5c08fe9ba34bd0dbcd873ec87ed

SHA256
3f54ee72f7b2b403c185def5fc70bd67f068831c94f0eba3c893ae291ca1b139

SHA512
37dd519d7cab1a07b2219240a8e4fff2e3d1217d5bde3349ac278af167b5ce3513b14ff9cc793481c0b9c3a37cd980474c12a9b00cdfee324a30ec16a32aa432

Download Submit
memory/2004-88-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2004-85-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2004-86-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2360-20-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2360-1-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2360-2-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2360-200-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2416-7-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2416-9-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download

Analysis

Sharing