cycbot | 6e8031b5452c7a96064458f2973830fdf365db4e557305de4feafeb4ea7be8d4

General

Target

JaffaCakes118_62057cbb585eec39d846931e1ce50696.exe
Size

198KB
MD5

62057cbb585eec39d846931e1ce50696
SHA1

6eed0fa7b9278b56f7a3678b27bd677de34dfa13
SHA256

6e8031b5452c7a96064458f2973830fdf365db4e557305de4feafeb4ea7be8d4
SHA512

82cec7454cc42008174756d131b7b6fa4ea54c027140f42542cc6e01e86ea15f4a3702dec9984a0025a4f2d9956524c782fef2c5bd772646bee353fdead58449
SSDEEP

6144:53MBEoRKYYnbgZFWACLTtj6vk1TjwWBtVv:58lanZecJjw8n

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2976-12-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral1/memory/2900-13-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral1/memory/2108-81-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral1/memory/2900-180-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2900-2-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2976-12-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2900-13-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2108-80-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2108-81-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2900-180-0x0000000000400000-0x0000000000454000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_62057cbb585eec39d846931e1ce50696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_62057cbb585eec39d846931e1ce50696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_62057cbb585eec39d846931e1ce50696.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2976	2900	JaffaCakes118_62057cbb585eec39d846931e1ce50696.exe	30
PID 2900 wrote to memory of 2976	2900	JaffaCakes118_62057cbb585eec39d846931e1ce50696.exe	30
PID 2900 wrote to memory of 2976	2900	JaffaCakes118_62057cbb585eec39d846931e1ce50696.exe	30
PID 2900 wrote to memory of 2976	2900	JaffaCakes118_62057cbb585eec39d846931e1ce50696.exe	30
PID 2900 wrote to memory of 2108	2900	JaffaCakes118_62057cbb585eec39d846931e1ce50696.exe	33
PID 2900 wrote to memory of 2108	2900	JaffaCakes118_62057cbb585eec39d846931e1ce50696.exe	33
PID 2900 wrote to memory of 2108	2900	JaffaCakes118_62057cbb585eec39d846931e1ce50696.exe	33
PID 2900 wrote to memory of 2108	2900	JaffaCakes118_62057cbb585eec39d846931e1ce50696.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62057cbb585eec39d846931e1ce50696.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62057cbb585eec39d846931e1ce50696.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62057cbb585eec39d846931e1ce50696.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62057cbb585eec39d846931e1ce50696.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2976
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62057cbb585eec39d846931e1ce50696.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62057cbb585eec39d846931e1ce50696.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\CE08.45A

Filesize
600B

MD5
5d4bd890b5e4b1c3bc92faf3f572b04e

SHA1
fb955d5ec6209b1842e9232c3d5a5de7f71abbf8

SHA256
a177d3574cc0e959ff0c2d7bb448ea693987197c7bca3f0d9f54ee527197e9ac

SHA512
516203d0147bcf39e925eb560e7463fd3c6f4ed3f490cfdfd0520405bdbbf40afb5e804b0ec0ab7b86bfd71134585a865d0e39f1f18fc4c52188895c5a450878

Download Submit
C:\Users\Admin\AppData\Roaming\CE08.45A

Filesize
996B

MD5
b7bb8d14f84fd70bbb2dce8c93cd7eb4

SHA1
ebbdd1b8fbb4557631c88bc8bc66e96f8bf071ee

SHA256
7444757591b1f88dc353c5eb3c9d524738d5ef26def879b882bbd4bdb91e4ee3

SHA512
ccbf432fe7cb23d230de19ee735438702e82f5d16c57f7acd3ec1fdc5c9a5ae829e06efeaf84765b31583325bea79314fd977115e35c1f471ff8c45db5c276ac

Download Submit
memory/2108-80-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2108-81-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2900-2-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2900-1-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2900-13-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2900-180-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2976-12-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing