cycbot | 88d5a35bf116571216f3c7bf3ca800b004ceaffefe228f5c9b654b3fe47f46c9

General

Target

JaffaCakes118_644c8286004e07849b7e5585b09eb9b0.exe
Size

199KB
MD5

644c8286004e07849b7e5585b09eb9b0
SHA1

17a2aae20d784d4f7595dbc96fd0aa2c8305e267
SHA256

88d5a35bf116571216f3c7bf3ca800b004ceaffefe228f5c9b654b3fe47f46c9
SHA512

08781d75f045853b3645110cc9167407215fce5e36f86e052248e547582a6add9f21f01452533dd11b5a3aace42ee625078ea774fe8f180a8e9aa6e375fc8d31
SSDEEP

6144:ViSRcu5Hl4dZIgO4M5TIjrPyrwqTbJkZOKQYiMM:7cuZudmh4M5Tur6sq5P1H

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/3852-14-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/3128-15-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/3128-16-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral2/memory/3492-127-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/3128-294-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3128-3-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3852-13-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3852-14-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3128-15-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3128-16-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/3492-126-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3492-127-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3128-294-0x0000000000400000-0x0000000000455000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_644c8286004e07849b7e5585b09eb9b0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_644c8286004e07849b7e5585b09eb9b0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_644c8286004e07849b7e5585b09eb9b0.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 3852	3128	JaffaCakes118_644c8286004e07849b7e5585b09eb9b0.exe	91
PID 3128 wrote to memory of 3852	3128	JaffaCakes118_644c8286004e07849b7e5585b09eb9b0.exe	91
PID 3128 wrote to memory of 3852	3128	JaffaCakes118_644c8286004e07849b7e5585b09eb9b0.exe	91
PID 3128 wrote to memory of 3492	3128	JaffaCakes118_644c8286004e07849b7e5585b09eb9b0.exe	100
PID 3128 wrote to memory of 3492	3128	JaffaCakes118_644c8286004e07849b7e5585b09eb9b0.exe	100
PID 3128 wrote to memory of 3492	3128	JaffaCakes118_644c8286004e07849b7e5585b09eb9b0.exe	100

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_644c8286004e07849b7e5585b09eb9b0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_644c8286004e07849b7e5585b09eb9b0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_644c8286004e07849b7e5585b09eb9b0.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_644c8286004e07849b7e5585b09eb9b0.exe startC:\Program Files (x86)\LP\2CCF\F46.exe%C:\Program Files (x86)\LP\2CCF
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3852
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_644c8286004e07849b7e5585b09eb9b0.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_644c8286004e07849b7e5585b09eb9b0.exe startC:\Users\Admin\AppData\Roaming\F5A84\9E42C.exe%C:\Users\Admin\AppData\Roaming\F5A84
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\F5A84\4200.5A8

Filesize
996B

MD5
7727eff584352924e1b2a102c152530c

SHA1
29d02caf4ef203c67d29cf0bbda203b310e2f27a

SHA256
80c8942c3987f5f24e8d8d88ce8cc056ae0f270d07ddaa972505d47712e9f5eb

SHA512
24eaf19d64fe160b0b326e272dae97c2cc39032dd2f5da79f085178cb44c949ea8205dafe9fbcb42b5dc1577b1533d9621639262f26b86116061fcc481d61660

Download Submit
C:\Users\Admin\AppData\Roaming\F5A84\4200.5A8

Filesize
600B

MD5
f5ceb289c8d0117e0ab0a574df05c4cb

SHA1
b61c14a9c7d98560cc93f33a88c11a6953826c33

SHA256
d4272322c79bf7a7a3dcda7e2a2f828aa1cf0d9c41834d256d608f10a002107f

SHA512
1f84a5d48db00b4385bcfb036bdc4877ae119b20cb279099900af7309056665d1035a4f6be08fde4f08aa2dd9afde0b25d2ad269d5b4e9561549111f2093e18f

Download Submit
C:\Users\Admin\AppData\Roaming\F5A84\4200.5A8

Filesize
1KB

MD5
29ac3804c39102530b96e8ca088aca74

SHA1
2c48be0dbc635cff065cab80f6f61ccbd44f072b

SHA256
700e068e415e09330cbffde2265c9ffef858ea02c9c34f15933c309e04ba6b60

SHA512
ab5835cc5215c54ebc6956de378c5174d6dec886e23d5a7f4581535f9de603bcc85d6712f49cc2bf0d154d670a4ea0c88130e8f7373fe7de896c18bcd091eb73

Download Submit
memory/3128-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3128-2-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3128-3-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3128-294-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3128-15-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3128-16-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3492-127-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3492-126-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3852-14-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3852-13-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing