cycbot | cff9b7d9b4a76d76c4f17647e0f9ea642b9022c29c8f35ec2feb0d2e98caed98

General

Target

JaffaCakes118_6df47399832469092d93a843afe8a801.exe
Size

159KB
MD5

6df47399832469092d93a843afe8a801
SHA1

907084fd9859df90912f3d4a1326f36f7016578f
SHA256

cff9b7d9b4a76d76c4f17647e0f9ea642b9022c29c8f35ec2feb0d2e98caed98
SHA512

7b7d8f48f5f283a8d558a4db84b46baf30cc71fb28520643bfc5cb10a1ddf3c3e0539ff6cdeb86030ee482fe3f72d3922d45bdceb3a3f97e39d75d51630428a1
SSDEEP

3072:z/VuDWDCXNuM+LAK/T3XBneCb33g88EkbezmBnA/2AltHLsRqX:zwDWEN9oJr3VX9qbQmBnA/Nbv

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/3708-7-0x0000000000400000-0x0000000000468000-memory.dmp	family_cycbot
behavioral2/memory/2240-15-0x0000000000400000-0x0000000000468000-memory.dmp	family_cycbot
behavioral2/memory/3760-78-0x0000000000400000-0x0000000000468000-memory.dmp	family_cycbot
behavioral2/memory/2240-190-0x0000000000400000-0x0000000000468000-memory.dmp	family_cycbot

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2240-2-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral2/memory/3708-7-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral2/memory/3708-6-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral2/memory/2240-15-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral2/memory/3760-78-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral2/memory/3760-77-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral2/memory/2240-190-0x0000000000400000-0x0000000000468000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6df47399832469092d93a843afe8a801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6df47399832469092d93a843afe8a801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6df47399832469092d93a843afe8a801.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 3708	2240	JaffaCakes118_6df47399832469092d93a843afe8a801.exe	84
PID 2240 wrote to memory of 3708	2240	JaffaCakes118_6df47399832469092d93a843afe8a801.exe	84
PID 2240 wrote to memory of 3708	2240	JaffaCakes118_6df47399832469092d93a843afe8a801.exe	84
PID 2240 wrote to memory of 3760	2240	JaffaCakes118_6df47399832469092d93a843afe8a801.exe	87
PID 2240 wrote to memory of 3760	2240	JaffaCakes118_6df47399832469092d93a843afe8a801.exe	87
PID 2240 wrote to memory of 3760	2240	JaffaCakes118_6df47399832469092d93a843afe8a801.exe	87

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6df47399832469092d93a843afe8a801.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6df47399832469092d93a843afe8a801.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6df47399832469092d93a843afe8a801.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6df47399832469092d93a843afe8a801.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3708
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6df47399832469092d93a843afe8a801.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6df47399832469092d93a843afe8a801.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\7F66.EE6

Filesize
600B

MD5
a88d87bf0f1b21a6c147c9eff205ea5c

SHA1
4420c74b5d0aa49906d417058c390324360b6db1

SHA256
baaeb89c64efbe0e7f41aa28d0ecbe4ee9483f497e47e5da1997f6757d1e471b

SHA512
90c782702d11f7eba561d145a75d20f0db3d275814a17043f3d24ab3252c3973a49cc8d7623ddefb1c8f704803ab9050d988a37033409d22de09e2d2bf027a28

Download Submit
C:\Users\Admin\AppData\Roaming\7F66.EE6

Filesize
1KB

MD5
ef8e483b51d36299c7dac3b37c912044

SHA1
7a5c1bbe7352b38a192450ca1c0cbcec1bf6106a

SHA256
b375644d4c861414760de123dcffda8e71064d8f7bc9952c881a90e3b30a53c3

SHA512
3cbd208d04672909113ec7b119e936d79775fced4239f020abd9b1e64a2e6c3209f93e47075541ff9f756c8450ff993b3ccbd5d3de00ce38620b61b815a50173

Download Submit
memory/2240-2-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2240-1-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2240-15-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2240-190-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/3708-7-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/3708-6-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/3708-5-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/3760-78-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/3760-77-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing