cycbot | 5b3ae2332a7f22049c9a343b2f23f8ad287205c66a71961f5cbfb5725613a330

General

Target

fbe5d0710601bd181e692ad4155f8d5f_JaffaCakes118.exe
Size

171KB
MD5

fbe5d0710601bd181e692ad4155f8d5f
SHA1

7915bc6a8333588c9a3642d77d97f47ba3921d7f
SHA256

5b3ae2332a7f22049c9a343b2f23f8ad287205c66a71961f5cbfb5725613a330
SHA512

8594285ca2075c54837846eb42f02736afb17de52fbc306265339e53115a173550641123e9a64c8fe3d212a24a82fd2e608848862a346a26d90da0d69a53b807
SSDEEP

3072:hWScF+ap1FkGGG/371UoeVeu+YKJa5Y/njtHiy9X/AV31aIKIr63jsFC:hWb9wGGG/RFWyRpy31am63jsF

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2696-5-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1856-13-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2700-78-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/1856-170-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1856-2-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2696-5-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1856-13-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2700-78-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1856-170-0x0000000000400000-0x000000000046A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbe5d0710601bd181e692ad4155f8d5f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbe5d0710601bd181e692ad4155f8d5f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbe5d0710601bd181e692ad4155f8d5f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2696	1856	fbe5d0710601bd181e692ad4155f8d5f_JaffaCakes118.exe	30
PID 1856 wrote to memory of 2696	1856	fbe5d0710601bd181e692ad4155f8d5f_JaffaCakes118.exe	30
PID 1856 wrote to memory of 2696	1856	fbe5d0710601bd181e692ad4155f8d5f_JaffaCakes118.exe	30
PID 1856 wrote to memory of 2696	1856	fbe5d0710601bd181e692ad4155f8d5f_JaffaCakes118.exe	30
PID 1856 wrote to memory of 2700	1856	fbe5d0710601bd181e692ad4155f8d5f_JaffaCakes118.exe	32
PID 1856 wrote to memory of 2700	1856	fbe5d0710601bd181e692ad4155f8d5f_JaffaCakes118.exe	32
PID 1856 wrote to memory of 2700	1856	fbe5d0710601bd181e692ad4155f8d5f_JaffaCakes118.exe	32
PID 1856 wrote to memory of 2700	1856	fbe5d0710601bd181e692ad4155f8d5f_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\fbe5d0710601bd181e692ad4155f8d5f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fbe5d0710601bd181e692ad4155f8d5f_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\fbe5d0710601bd181e692ad4155f8d5f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fbe5d0710601bd181e692ad4155f8d5f_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2696
- C:\Users\Admin\AppData\Local\Temp\fbe5d0710601bd181e692ad4155f8d5f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fbe5d0710601bd181e692ad4155f8d5f_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\1786.CE6

Filesize
1KB

MD5
3ee80a8b6d41d4fe381bbca86bfec029

SHA1
fc9a0fff94c03a5c78c3aedd3fb3e4b56ca696d0

SHA256
4ec9b315daf38e6c60f30c9a918d79f026b06b542ff52686c239faaf11cebcad

SHA512
872cc0ad907b0676fe59df10704b406031d468f6e415ceaedff17024b15c5ad25a4c06d68c834a741550ac7557fd897004a86913687d01458716a3a643a6eba6

Download Submit
C:\Users\Admin\AppData\Roaming\1786.CE6

Filesize
600B

MD5
3df28f550bc54b9ed70dcfb3f92f125c

SHA1
edbcfbbf46221457a729c3a296f23bf61150dc95

SHA256
00039ec33e54e5cd3b263c2547ad8a005119a3fee8a4462c5a7cf9ce5e954980

SHA512
8069f3e1eed498c4bb401f14783e0a7ca65048b7c1a7040c9b72f083beba8550d500e6c231045b3b3fbbc399ba74af5313d3ad7688a363c71ee73ed0c381141c

Download Submit
C:\Users\Admin\AppData\Roaming\1786.CE6

Filesize
996B

MD5
963f078a2ae22fa1121bd95b4fa203f6

SHA1
8c0ec0f7446506e0e97a791b44cac9674ee36e5c

SHA256
f4ad211cd6f2f43ca1201bda20b9bbc3c3980c874b8d479cf6ad812e14affe2b

SHA512
52e9c0f8419681bcabe9a2b0b7b8c5ed69bcd869b206363f7b3b201511896d6486dcec607c83b4711d1ccb1609621c48a2dfe639381c229186d75939ff4addfa

Download Submit
memory/1856-1-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1856-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1856-13-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1856-170-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2696-5-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2700-78-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing