cycbot | 13acb4e62294b06f8c273e0c3bb9728fde6069e4e6b5e0e709ba68673bccbedb

General

Target

JaffaCakes118_1b21178c2bfba9d0f395dd5f1b97295b.exe
Size

181KB
MD5

1b21178c2bfba9d0f395dd5f1b97295b
SHA1

06a1539a431de65838f2e1b319244f8a578b90e8
SHA256

13acb4e62294b06f8c273e0c3bb9728fde6069e4e6b5e0e709ba68673bccbedb
SHA512

7ee145e9b8b5a978eb22ba76b1ee1cde2b80ad8ab5f120732dea474732a7c914e1433e17ccbdbe1330d01db7e07d42ff1aa9e41a77cb9898eb9713666f0c21a0
SSDEEP

3072:/RoXYWYwC2Dkur+gvyjV0mff9SpAEYaUFucx2vQcCMHML26HK0Qn4aYjL1axNQ8D:wY5YkurPmVbnqqaU4vQcCMsenBYfer5l

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2536-12-0x0000000000400000-0x0000000000450000-memory.dmp	family_cycbot
behavioral1/memory/1728-13-0x0000000000400000-0x0000000000450000-memory.dmp	family_cycbot
behavioral1/memory/3056-74-0x0000000000400000-0x0000000000450000-memory.dmp	family_cycbot
behavioral1/memory/1728-183-0x0000000000400000-0x0000000000450000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1728-2-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2536-12-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1728-13-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/3056-74-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1728-183-0x0000000000400000-0x0000000000450000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1b21178c2bfba9d0f395dd5f1b97295b.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2536	1728	JaffaCakes118_1b21178c2bfba9d0f395dd5f1b97295b.exe	30
PID 1728 wrote to memory of 2536	1728	JaffaCakes118_1b21178c2bfba9d0f395dd5f1b97295b.exe	30
PID 1728 wrote to memory of 2536	1728	JaffaCakes118_1b21178c2bfba9d0f395dd5f1b97295b.exe	30
PID 1728 wrote to memory of 2536	1728	JaffaCakes118_1b21178c2bfba9d0f395dd5f1b97295b.exe	30
PID 1728 wrote to memory of 3056	1728	JaffaCakes118_1b21178c2bfba9d0f395dd5f1b97295b.exe	32
PID 1728 wrote to memory of 3056	1728	JaffaCakes118_1b21178c2bfba9d0f395dd5f1b97295b.exe	32
PID 1728 wrote to memory of 3056	1728	JaffaCakes118_1b21178c2bfba9d0f395dd5f1b97295b.exe	32
PID 1728 wrote to memory of 3056	1728	JaffaCakes118_1b21178c2bfba9d0f395dd5f1b97295b.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b21178c2bfba9d0f395dd5f1b97295b.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b21178c2bfba9d0f395dd5f1b97295b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b21178c2bfba9d0f395dd5f1b97295b.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b21178c2bfba9d0f395dd5f1b97295b.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  PID:2536
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b21178c2bfba9d0f395dd5f1b97295b.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b21178c2bfba9d0f395dd5f1b97295b.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\0085.CF5

Filesize
600B

MD5
cd07fe1c17ff11a535e7236e0c3b9206

SHA1
46f863c1d21c5ea0ffd1ab5bf8338087cd420ba7

SHA256
6d70253798dbaace031b1da69c5be25538123ee5a05f28e55b952b4320b1c8af

SHA512
a353226f7a9dfe4c8e4f3d00a098482b56a4d6c6779f7d34afcaade50b622eacd97917be278b8326c9dacded629f7708dfaccca01a2ea072e8a7cc834622a8a6

Download Submit
C:\Users\Admin\AppData\Roaming\0085.CF5

Filesize
1KB

MD5
aa2830e6fcdd09b6a492157e72b9854d

SHA1
4bddce682314696071edcfc1a2553c9417b8f3d8

SHA256
e7c81571feb50aa2d7843af61f8672d7c027a51a9c54d6230294ddf96721dea7

SHA512
b844750d62c99d9bff616f904aba32a4586e21eba72f5bebaf92ac0df7e436f84ac5c151dd70ffbfee84aba89c407860582594fdb3d25268d9392847d1c3378a

Download Submit
C:\Users\Admin\AppData\Roaming\0085.CF5

Filesize
996B

MD5
e03d06b06aaa9045d49e795142d94d4f

SHA1
7fbfb13c67e7e4bcb396629ebb78168ac4a79150

SHA256
c82e0c718090e256098bd6ba8ba06f9bff7fae26644ec75e0fd03996dfb61e35

SHA512
d377980c7704c7670a8e8bd6b12ef7d38b5fb6a13166b5b6d01aded4cb50055dfd0480f018e8c7dae701593e90e36af5d2658757550035c4c83d6c1d7708ec26

Download Submit
memory/1728-1-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1728-2-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1728-13-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1728-183-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2536-12-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3056-74-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing