cycbot | 554b6d86320bcde0116a2295ea88d08204a8954bde3a309292c1899ac089be89

General

Target

fd67bacae904767f1a03549b40df8c2b_JaffaCakes118.exe
Size

186KB
MD5

fd67bacae904767f1a03549b40df8c2b
SHA1

19f9aee4123950ce0479248eebfb664dee965880
SHA256

554b6d86320bcde0116a2295ea88d08204a8954bde3a309292c1899ac089be89
SHA512

02bbb8b80023cb1442896e76121741419035d5c8ddecf8268dc8d1edf5271c0e9f3b22a4cb5dfdf5aae670e74018c948b62255faa37e766ee01a55f15dc7d35a
SSDEEP

3072:AHoD8YbYxBB7n+mD1//Csd/xcVzwllyVE2PdkPEPiLrz3NOJ99fNF9nC4Oien8pm:2Dxj6Y1nCkysRIuPEUOf9ZnUqICS

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/2460-12-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral2/memory/4216-14-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral2/memory/4060-80-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral2/memory/4216-193-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4216-2-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/2460-12-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/4216-14-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/4060-79-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/4060-80-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/4216-193-0x0000000000400000-0x000000000044E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd67bacae904767f1a03549b40df8c2b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd67bacae904767f1a03549b40df8c2b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd67bacae904767f1a03549b40df8c2b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 2460	4216	fd67bacae904767f1a03549b40df8c2b_JaffaCakes118.exe	82
PID 4216 wrote to memory of 2460	4216	fd67bacae904767f1a03549b40df8c2b_JaffaCakes118.exe	82
PID 4216 wrote to memory of 2460	4216	fd67bacae904767f1a03549b40df8c2b_JaffaCakes118.exe	82
PID 4216 wrote to memory of 4060	4216	fd67bacae904767f1a03549b40df8c2b_JaffaCakes118.exe	87
PID 4216 wrote to memory of 4060	4216	fd67bacae904767f1a03549b40df8c2b_JaffaCakes118.exe	87
PID 4216 wrote to memory of 4060	4216	fd67bacae904767f1a03549b40df8c2b_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\fd67bacae904767f1a03549b40df8c2b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd67bacae904767f1a03549b40df8c2b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Users\Admin\AppData\Local\Temp\fd67bacae904767f1a03549b40df8c2b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fd67bacae904767f1a03549b40df8c2b_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2460
- C:\Users\Admin\AppData\Local\Temp\fd67bacae904767f1a03549b40df8c2b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fd67bacae904767f1a03549b40df8c2b_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\83A6.4B0

Filesize
1KB

MD5
c6b1f9fadbf4ad2a5fce98e756c6e42d

SHA1
572c670f7c3833b8c39611e6688a165dc1605673

SHA256
22119640f807d9dd0f939a4bfc987b28d1f47ca7194043fcd2275276521b492e

SHA512
7a8fb48f5de03fcd282fe0e032fd8a786d7aa0f053dc0076f8549b7c904cea48f3243045b3eeca25d936ee5981fdb13e4b34c2ce3c66f218f47ad0000b1ac867

Download Submit
C:\Users\Admin\AppData\Roaming\83A6.4B0

Filesize
600B

MD5
16777b3b3c7ccf9c74097f3d98631215

SHA1
df51e01be2fd9b20c617d703a5ed07aca2825b7d

SHA256
63d83e8512976ea78d3270b674f92e43ebf240977d59b9fdb66178e3f8603906

SHA512
866cd434ff7312957efab5538b0e9ff69f5c7afa7194c1a2814abc29be5c491da076c9b8f9e5b0385212aa7eabb6858ca53d0755024f6eccfd6510d1e2ad3d7a

Download Submit
C:\Users\Admin\AppData\Roaming\83A6.4B0

Filesize
996B

MD5
e47e4e7bb23be782116a3d087367add7

SHA1
ad774b7a00abfe96c4777b8850025266003a72e8

SHA256
ea77f59f31db4bb4b98483c4d03036e03fd6ef4a27aa23cbec573c4704f1c3a3

SHA512
0248ad636d439557b249acdaff089477d39578d17ad34f4d67de0648d5a47a1d4dd97a1d0ca995e31f0adca1548b00eabb987919b7a1796c0e5a41d6c249dccb

Download Submit
memory/2460-12-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4060-79-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4060-78-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4060-80-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4216-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4216-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4216-14-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4216-193-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing