cycbot | bcf161d989a1a814d952a056fc776b790bcc09b79db3f9125c2cb5e8226c264f

General

Target

JaffaCakes118_4a22e397c5f22fd5be3a3f50f1d67870.exe
Size

188KB
MD5

4a22e397c5f22fd5be3a3f50f1d67870
SHA1

87f10d41f4f05bc2dd6c165748fb8281babbd658
SHA256

bcf161d989a1a814d952a056fc776b790bcc09b79db3f9125c2cb5e8226c264f
SHA512

07f153333de634c3119042d40af2b2fcd7a7eefa135f93e6e351905480b31da3accfcfeb4d9ec691086a93e6fa999a5b228676a251ca87df94551a6357d88060
SSDEEP

3072:plUp7HKMxS8hiVDebqyTq5HnkVX8YDq/lWn4hXRboojgzSt1jUm7VPfi:op7qJnDebqywEVXlgAKcokzGdU+hq

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/2908-12-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/2024-13-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/2024-14-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral2/memory/2412-83-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/2024-182-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2024-2-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2908-12-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2024-13-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2024-14-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/2412-83-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2024-182-0x0000000000400000-0x0000000000455000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4a22e397c5f22fd5be3a3f50f1d67870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4a22e397c5f22fd5be3a3f50f1d67870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4a22e397c5f22fd5be3a3f50f1d67870.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2908	2024	JaffaCakes118_4a22e397c5f22fd5be3a3f50f1d67870.exe	83
PID 2024 wrote to memory of 2908	2024	JaffaCakes118_4a22e397c5f22fd5be3a3f50f1d67870.exe	83
PID 2024 wrote to memory of 2908	2024	JaffaCakes118_4a22e397c5f22fd5be3a3f50f1d67870.exe	83
PID 2024 wrote to memory of 2412	2024	JaffaCakes118_4a22e397c5f22fd5be3a3f50f1d67870.exe	92
PID 2024 wrote to memory of 2412	2024	JaffaCakes118_4a22e397c5f22fd5be3a3f50f1d67870.exe	92
PID 2024 wrote to memory of 2412	2024	JaffaCakes118_4a22e397c5f22fd5be3a3f50f1d67870.exe	92

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4a22e397c5f22fd5be3a3f50f1d67870.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4a22e397c5f22fd5be3a3f50f1d67870.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4a22e397c5f22fd5be3a3f50f1d67870.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4a22e397c5f22fd5be3a3f50f1d67870.exe startC:\Program Files (x86)\LP\B836\B6C.exe%C:\Program Files (x86)\LP\B836
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2908
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4a22e397c5f22fd5be3a3f50f1d67870.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4a22e397c5f22fd5be3a3f50f1d67870.exe startC:\Users\Admin\AppData\Roaming\6A01E\85BB8.exe%C:\Users\Admin\AppData\Roaming\6A01E
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\6A01E\E0FC.A01

Filesize
1KB

MD5
e85b9e0c3c1c9bb9ac6c7efddf0003b6

SHA1
1f576df81d33dc11eed6097e4ec46e2aade61058

SHA256
c068d514dc69736d775a1038057e6a5eeeb9656e2425a8063843141aa2407437

SHA512
6cab34055d532fc5904eac224ed0e1d6bf19d20d8ae11a786e1eb870caec32c75f097ea6844f1df751828ee992f47eb25279cb87f614d7e61cda682733323fae

Download Submit
C:\Users\Admin\AppData\Roaming\6A01E\E0FC.A01

Filesize
600B

MD5
21390fe69f0cbb8b80a156b16aabab2d

SHA1
eee19f4419b209d7ca4f17569f457ec1d4f77aa6

SHA256
de93a9bbce83de20df07b0859b3bb0c558ae76662f6d8247ae456d812eeb398e

SHA512
e13012c624b9c8026c3d38b3c30357c2554f561df30fd8336db07a11957eb40b2583d88c0a8d27fa41a1c19485b68f2ab2ed26106f3192e5cb1991335ba5999a

Download Submit
C:\Users\Admin\AppData\Roaming\6A01E\E0FC.A01

Filesize
996B

MD5
8b861687d2d2717bf9577ea29d8e6b0d

SHA1
8bc003df8a8c3e6a6f731eac6d94297e829113a7

SHA256
b18650f845ffdedfad7059c75b8cfb8c947ceaf01791c5d5c04e5495c89567db

SHA512
594d3be58333b1b48cdfeefee094f636161f9c757c8c08571e4ecc91e21e234fc8e9c92e3f37f19dd0a9b6d5d41d3ba89492eca66ce2ff38f005e06e908eb380

Download Submit
memory/2024-1-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2024-2-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2024-13-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2024-14-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2024-182-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2412-83-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2908-11-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2908-12-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing