cycbot | b8f8d03991963f81e13168116d421acfc358c860a30a1eedcf28ceba03796803

General

Target

f707721a62c03d5d0cf1c58df729eb97_JaffaCakes118.exe
Size

176KB
MD5

f707721a62c03d5d0cf1c58df729eb97
SHA1

aadce05791a87fa160d0a478e32896bd50d0d38a
SHA256

b8f8d03991963f81e13168116d421acfc358c860a30a1eedcf28ceba03796803
SHA512

cd0086bed043255be98b4d0d30433241e328d4ace2bad59d6ae48b2ac9321cec4941afd01026f57d4a84346b786bf99fe95898498f4ac2c7812b9cf0a1a06284
SSDEEP

3072:GHZEJV6VCkqQaA1JHrW89TVOf7f10mSAJpyLwhOcXA0k4CaTauNHHt/hc:EK6VCkv38SmzhQ0k4AuhHtu

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2160-8-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/2776-16-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/1896-76-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot
behavioral1/memory/2776-186-0x0000000000400000-0x000000000044B000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2776-2-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2160-6-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2160-8-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2776-16-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/1896-75-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/1896-76-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2776-186-0x0000000000400000-0x000000000044B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f707721a62c03d5d0cf1c58df729eb97_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f707721a62c03d5d0cf1c58df729eb97_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f707721a62c03d5d0cf1c58df729eb97_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2160	2776	f707721a62c03d5d0cf1c58df729eb97_JaffaCakes118.exe	30
PID 2776 wrote to memory of 2160	2776	f707721a62c03d5d0cf1c58df729eb97_JaffaCakes118.exe	30
PID 2776 wrote to memory of 2160	2776	f707721a62c03d5d0cf1c58df729eb97_JaffaCakes118.exe	30
PID 2776 wrote to memory of 2160	2776	f707721a62c03d5d0cf1c58df729eb97_JaffaCakes118.exe	30
PID 2776 wrote to memory of 1896	2776	f707721a62c03d5d0cf1c58df729eb97_JaffaCakes118.exe	32
PID 2776 wrote to memory of 1896	2776	f707721a62c03d5d0cf1c58df729eb97_JaffaCakes118.exe	32
PID 2776 wrote to memory of 1896	2776	f707721a62c03d5d0cf1c58df729eb97_JaffaCakes118.exe	32
PID 2776 wrote to memory of 1896	2776	f707721a62c03d5d0cf1c58df729eb97_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\f707721a62c03d5d0cf1c58df729eb97_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f707721a62c03d5d0cf1c58df729eb97_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\f707721a62c03d5d0cf1c58df729eb97_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f707721a62c03d5d0cf1c58df729eb97_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2160
- C:\Users\Admin\AppData\Local\Temp\f707721a62c03d5d0cf1c58df729eb97_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f707721a62c03d5d0cf1c58df729eb97_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\D183.B9F

Filesize
1KB

MD5
fae21177609e7bc4e096ccc2ea8ba896

SHA1
207131b0abd58050922cd9f194296ce797adebab

SHA256
0800e91cb02aab499c010bcf1b6f53cd8eef4872924912810b6677329d94f875

SHA512
20de41af8e0c74d0b7d8ff9db2c0b343364aa3ea52416bdcae281b53108bef1a368a897c45b314be9deef82e921d0f127880986f80026ff35027bf9120a4aac0

Download Submit
C:\Users\Admin\AppData\Roaming\D183.B9F

Filesize
600B

MD5
e57203cbe51fef5db6a625e951ba03e4

SHA1
559477acf7c72d646f6fb8e0ab1ec5d8de3bb52a

SHA256
b249a3c202733db5e3389e2adea893a0ccbbef561d73617a29419d104be04893

SHA512
c6a91a959b893405a78cd05ee8210fb6d24b419d415723fdd93b8cb1b31e853633d4990a24c2e232e284bfb3b2998922993541046da2e51a5c12b5cb20ac9061

Download Submit
memory/1896-75-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1896-76-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2160-6-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2160-8-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2160-5-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2776-1-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2776-2-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2776-16-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2776-186-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download

Analysis

Sharing