cycbot | a66f96b9d5d54443101edac80b7d49db6f4ad755cf21bd1521a5aa76e5245cc1

General

Target

JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe
Size

190KB
MD5

098490ce23ae57ebdecaa3ff542602a6
SHA1

de3e9ca821fca772fdef03cebcc8130a84a8a48d
SHA256

a66f96b9d5d54443101edac80b7d49db6f4ad755cf21bd1521a5aa76e5245cc1
SHA512

d450517f313a2771a966c808990a8d6633b86c34de1261ddfc78841c2920e583ce81c073ccbb309afe70127d7e4aae67f679e9af661f8aae22f1d2d314bb4654
SSDEEP

3072:FvvCIrf5ZOoxFWvVtgOEzhMCxjCoKbHkD5YvbCMxQpJ8EvHGUyp3YvL8hoceInXC:9CRQFJPx+oCvmKQNHvwZhocj+h3

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2892-5-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot
behavioral1/memory/2744-12-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot
behavioral1/memory/556-71-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot
behavioral1/memory/2744-167-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot
behavioral1/memory/2744-206-0x0000000000400000-0x0000000000447000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2744-2-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2892-5-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2744-12-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/556-70-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/556-71-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2744-167-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2744-206-0x0000000000400000-0x0000000000447000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2892	2744	JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe	30
PID 2744 wrote to memory of 2892	2744	JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe	30
PID 2744 wrote to memory of 2892	2744	JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe	30
PID 2744 wrote to memory of 2892	2744	JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe	30
PID 2744 wrote to memory of 556	2744	JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe	32
PID 2744 wrote to memory of 556	2744	JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe	32
PID 2744 wrote to memory of 556	2744	JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe	32
PID 2744 wrote to memory of 556	2744	JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2892
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\58D2.19A

Filesize
1KB

MD5
5b88cfc98ab21a634d71d6b6fb6220a3

SHA1
878e83d39a8e52239dcd3bb6b41a8965159e407d

SHA256
ec6f5aafc6c656843fc1fae7bc00a9dddf132648fcb035b49fe3b26a13c94682

SHA512
866c9a295283393b12ba260b30dfd2ad0e0e672124779e2fc728fca259292af2ed89cef3fe96d2eff9c965192a5acdcee850f86e1d813d90d1dd0a68a523902e

Download Submit
C:\Users\Admin\AppData\Roaming\58D2.19A

Filesize
600B

MD5
267461a622d793a0a7c235e026160721

SHA1
f975a9bd941f13fa4b93209909674c26f065d079

SHA256
e69e193db6c58ec96650f2534b1241abac236a2fa62a61714b02b95e2fedd6bb

SHA512
82d32c8f926a678446d7483c1a7519acf321ba75c1a439bed610789442c540a7f9cd4ab61e5829c33639d32e74dcb002a364fa86eb7dc9faee67206e1d8bae2e

Download Submit
C:\Users\Admin\AppData\Roaming\58D2.19A

Filesize
996B

MD5
1a987f6ec3097f7dd34bbfc43eeb39e8

SHA1
2d13077f20110133b510885397827b0d79c2b230

SHA256
3eb12d5ea43483e3fbbc7530172d1e8cc5947d1510a96172f1deadda170bc1e7

SHA512
cdf8cf9401f5d3492d52da5cf537b1cf686e35f6d12bf48df4dd6843bd835463a70d2310c48cfc83386bb7f10e2186c60a55594f61f1e76174d034e56f6ec25e

Download Submit
memory/556-70-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/556-71-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2744-1-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2744-2-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2744-12-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2744-167-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2744-206-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2892-5-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing