cycbot | 1007208bf69be0bed05fa22242aa06966693d33793a824e7c73323c10f1a3fb6

General

Target

JaffaCakes118_1d75597340a49b719b6053b577ace669.exe
Size

185KB
MD5

1d75597340a49b719b6053b577ace669
SHA1

06a5a5e027a009ac083d685cee808ebc73c45502
SHA256

1007208bf69be0bed05fa22242aa06966693d33793a824e7c73323c10f1a3fb6
SHA512

1f4655f4a0e083f2fe21a5f6c64f830fad04de0d51594ba18e3f98ea134357fc529eea83358d34eb83208fea485afb8de3f6a848f0b0e72c5669f21de7362570
SSDEEP

3072:t8+rfhgzISx1YZFwKm2BpxrHlsAY4hTj7KDY2ASxT7upC5w1cbw1zHZoOC3:tPNgzIEe+mLlsEh2OSxu05w1cshZoO

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/1032-13-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/1164-14-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/1164-15-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral2/memory/2976-138-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/1164-305-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral2/memory/1164-307-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1164-2-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/1032-12-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/1032-13-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/1164-14-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/1164-15-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/2976-136-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2976-138-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/1164-305-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/1164-307-0x0000000000400000-0x0000000000455000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1d75597340a49b719b6053b577ace669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1d75597340a49b719b6053b577ace669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1d75597340a49b719b6053b577ace669.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1032	1164	JaffaCakes118_1d75597340a49b719b6053b577ace669.exe	82
PID 1164 wrote to memory of 1032	1164	JaffaCakes118_1d75597340a49b719b6053b577ace669.exe	82
PID 1164 wrote to memory of 1032	1164	JaffaCakes118_1d75597340a49b719b6053b577ace669.exe	82
PID 1164 wrote to memory of 2976	1164	JaffaCakes118_1d75597340a49b719b6053b577ace669.exe	88
PID 1164 wrote to memory of 2976	1164	JaffaCakes118_1d75597340a49b719b6053b577ace669.exe	88
PID 1164 wrote to memory of 2976	1164	JaffaCakes118_1d75597340a49b719b6053b577ace669.exe	88

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d75597340a49b719b6053b577ace669.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d75597340a49b719b6053b577ace669.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d75597340a49b719b6053b577ace669.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d75597340a49b719b6053b577ace669.exe startC:\Program Files (x86)\LP\24BB\C25.exe%C:\Program Files (x86)\LP\24BB
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1032
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d75597340a49b719b6053b577ace669.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d75597340a49b719b6053b577ace669.exe startC:\Users\Admin\AppData\Roaming\BEC24\FCE24.exe%C:\Users\Admin\AppData\Roaming\BEC24
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\BEC24\4CCF.EC2

Filesize
996B

MD5
16ef156af23924dd790bdc013f6c523e

SHA1
d6fd341e2e813e50f79f23540dbf8964b79a4f66

SHA256
dd5b79cffb2e2f9334fc89c2c5b02fcdf683a060c379a63a358db78e9b855635

SHA512
89b1e8820e3b951193382d3ef1efaada8b62971799578c921ea8d1aadef723c4b2ede143bcb6aa0f322d05ad40c1e56c1ad95b190273ed298936d83bc390120b

Download Submit
C:\Users\Admin\AppData\Roaming\BEC24\4CCF.EC2

Filesize
600B

MD5
21d155db04b5990959e99399a772a72d

SHA1
ed3d9672298943c0fbb9c4189609cf6ad479f232

SHA256
23edca4ed80a628bf28dc70b79eea6169311d6996423aeb9473543d7ae4337d2

SHA512
e8aceff96f8c49291ab7558e08f99319b4cc438b2409c11871b1c7dab28b13767934abb8d51cc3552bc82fba06ac3305d65a15c474079b790dd7fcefe659c673

Download Submit
C:\Users\Admin\AppData\Roaming\BEC24\4CCF.EC2

Filesize
1KB

MD5
7fb1a1cf763a1dc8256491c282b6383c

SHA1
dccd3e7dc18c21f262ca3ef32673073cd3fb4147

SHA256
e78c4269fcaef547cd7d0895fa63dd17926208403355d626fd986db56e931eda

SHA512
039101298a3c2e092949b2535e44f5b00b8854114f0cfeb6732ff8ce692eba039057611544e9619cfcd3238d37031fe2d5e7cdc5ae5bb9ab6c266dc5f43d22a7

Download Submit
memory/1032-12-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1032-11-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1032-13-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1164-15-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1164-1-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1164-14-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1164-2-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1164-305-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1164-307-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2976-136-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2976-138-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing