cycbot | 6b6e85072317a2d8c3e02dae8ab7f5ab34cdf07c65f671a598fba7fde1b024bf

General

Target

fe56ad696b022ec13cf5576f16184c94_JaffaCakes118.exe
Size

211KB
MD5

fe56ad696b022ec13cf5576f16184c94
SHA1

8d14e7689b832ac41bfdc87b7fc13949b214dce8
SHA256

6b6e85072317a2d8c3e02dae8ab7f5ab34cdf07c65f671a598fba7fde1b024bf
SHA512

c4bac6c45d0216dcbd86e6a64c59fd76a427d136860e06d8e3d4f0bc3e44159a187254a48cb6f82e0fadd22cecd648f5d3a8f39c5ca5e563d2d005a3446bc89a
SSDEEP

3072:AyTRWCQCOeXJYc4QlbR8dgkRKed/WTpt04thQhUyJHJtMRZKZDPN:FWCFOLSlbR8dXRKedOTptOh1JrM7c

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/3012-7-0x0000000000400000-0x000000000044F000-memory.dmp	family_cycbot
behavioral1/memory/2376-15-0x0000000000400000-0x000000000044F000-memory.dmp	family_cycbot
behavioral1/memory/3040-81-0x0000000000400000-0x000000000044F000-memory.dmp	family_cycbot
behavioral1/memory/2376-185-0x0000000000400000-0x000000000044F000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2376-2-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3012-6-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3012-7-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/2376-15-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3040-80-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3040-81-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/2376-185-0x0000000000400000-0x000000000044F000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe56ad696b022ec13cf5576f16184c94_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe56ad696b022ec13cf5576f16184c94_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe56ad696b022ec13cf5576f16184c94_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 3012	2376	fe56ad696b022ec13cf5576f16184c94_JaffaCakes118.exe	31
PID 2376 wrote to memory of 3012	2376	fe56ad696b022ec13cf5576f16184c94_JaffaCakes118.exe	31
PID 2376 wrote to memory of 3012	2376	fe56ad696b022ec13cf5576f16184c94_JaffaCakes118.exe	31
PID 2376 wrote to memory of 3012	2376	fe56ad696b022ec13cf5576f16184c94_JaffaCakes118.exe	31
PID 2376 wrote to memory of 3040	2376	fe56ad696b022ec13cf5576f16184c94_JaffaCakes118.exe	33
PID 2376 wrote to memory of 3040	2376	fe56ad696b022ec13cf5576f16184c94_JaffaCakes118.exe	33
PID 2376 wrote to memory of 3040	2376	fe56ad696b022ec13cf5576f16184c94_JaffaCakes118.exe	33
PID 2376 wrote to memory of 3040	2376	fe56ad696b022ec13cf5576f16184c94_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\fe56ad696b022ec13cf5576f16184c94_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe56ad696b022ec13cf5576f16184c94_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\fe56ad696b022ec13cf5576f16184c94_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fe56ad696b022ec13cf5576f16184c94_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3012
- C:\Users\Admin\AppData\Local\Temp\fe56ad696b022ec13cf5576f16184c94_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fe56ad696b022ec13cf5576f16184c94_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\9F3C.0EE

Filesize
300B

MD5
f939e5c2257b7d624dd0311559840cef

SHA1
c290c80d80d8b61e1b9b973ecc684e47467f0398

SHA256
2b1ecce8f4f552bb962665270f74f16a227b0ef98b205f264be965432815abb8

SHA512
127fe16cf7c16d78b04eefef4d9a01961d799ed07d32f6a1e2987606aae65151a380bd79953940c522c316c325e51711cb0d970384f8a4a46141b213acd13073

Download Submit
C:\Users\Admin\AppData\Roaming\9F3C.0EE

Filesize
1KB

MD5
15e22318954adbff0572bfc42cae8d59

SHA1
d3725046fafc80513cf5f940f84d682d206df864

SHA256
40f824c50d87db4b4417269f38feac7cba9f89e405b6e50f03331345b260e681

SHA512
3172f210a24f4adcbae147b1b93fd3f361c7f724f0145b6d16e64c33cae4b16ac8688d195ce39cd42bece0241d68021ce8b71c3f11f602cd5e475f572ba417d6

Download Submit
C:\Users\Admin\AppData\Roaming\9F3C.0EE

Filesize
600B

MD5
bd811438210cb4f2a4c0052f4acaf94a

SHA1
e4830876a584f14246a93361e98ae287a57c50cc

SHA256
06f282cad84a5fc565a9f869a7fdddc6715d38efd7238de5766216d7b9df07fd

SHA512
c8d9b84d92dfecbbd7807059fa109f25875764829fa4c07ef88783e5b9c7a622e9cfb049241971d64b580327017b31af7e05c6e96f5e23d2869acc4603aa8110

Download Submit
C:\Users\Admin\AppData\Roaming\9F3C.0EE

Filesize
996B

MD5
bdd0419cc58808036f57e44872fb75d1

SHA1
012b3b954de1e7434829228a33115314f58e3e1a

SHA256
3098794d7c4a24dce3448f02218bb3b6947e7ba351c27687935f741509d61710

SHA512
159e87ce9478a1203e231c8413278b6b1b486ac417741665eb22d393b79accb27004c2ab53991d8cf6995042fde0754d0bf8fd2d2a126559bb89eb10c9ea938f

Download Submit
memory/2376-2-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2376-185-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2376-1-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2376-15-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3012-5-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3012-7-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3012-6-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3040-81-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3040-80-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download

Analysis

Sharing