cycbot | 7117f400389daec3eed71922bcf812fbd7c5699e4bc30a5aba2baa46509e7e9b

General

Target

JaffaCakes118_1d84a58107f14665796825fb3a591626.exe
Size

172KB
MD5

1d84a58107f14665796825fb3a591626
SHA1

5e8a80b7b2e232c14560f5ef2d045201c3020c4d
SHA256

7117f400389daec3eed71922bcf812fbd7c5699e4bc30a5aba2baa46509e7e9b
SHA512

4bcaf37f291a8be779423a962515de6aa757f17f7927e41e9bf011df78b0fe887fb951e18599d5da339bfbd59c938da8fafae890885482447051f92be9b417d2
SSDEEP

3072:dJvAiEkcg1eXOsjktHOSMcgen1+1mE0y7P59SC92pSgMpHPqX2GtUN2MP0scUCzQ:dJvAiErGSgtNE1b7B9SC92zf2G2NMscV

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2988-17-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/2988-19-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/1664-20-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/2036-90-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/2036-92-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/1664-196-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1664-2-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2988-17-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2988-19-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/1664-20-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2036-90-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2036-92-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/1664-196-0x0000000000400000-0x000000000046B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1d84a58107f14665796825fb3a591626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1d84a58107f14665796825fb3a591626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1d84a58107f14665796825fb3a591626.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2988	1664	JaffaCakes118_1d84a58107f14665796825fb3a591626.exe	30
PID 1664 wrote to memory of 2988	1664	JaffaCakes118_1d84a58107f14665796825fb3a591626.exe	30
PID 1664 wrote to memory of 2988	1664	JaffaCakes118_1d84a58107f14665796825fb3a591626.exe	30
PID 1664 wrote to memory of 2988	1664	JaffaCakes118_1d84a58107f14665796825fb3a591626.exe	30
PID 1664 wrote to memory of 2036	1664	JaffaCakes118_1d84a58107f14665796825fb3a591626.exe	32
PID 1664 wrote to memory of 2036	1664	JaffaCakes118_1d84a58107f14665796825fb3a591626.exe	32
PID 1664 wrote to memory of 2036	1664	JaffaCakes118_1d84a58107f14665796825fb3a591626.exe	32
PID 1664 wrote to memory of 2036	1664	JaffaCakes118_1d84a58107f14665796825fb3a591626.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d84a58107f14665796825fb3a591626.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d84a58107f14665796825fb3a591626.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d84a58107f14665796825fb3a591626.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d84a58107f14665796825fb3a591626.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2988
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d84a58107f14665796825fb3a591626.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d84a58107f14665796825fb3a591626.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\9AEE.C0A

Filesize
597B

MD5
efd789e994ed8be7d47acb1b5771ab0d

SHA1
8accac8afa17380f45180063eec776e7f9465109

SHA256
e214f0a29c377f79e5a4f1501eb607002bd744ea59d083b9abc7ff066e75f02e

SHA512
af66a1cc5beb94f5a16703da7e0d7b1385a51a5795d9969faea132a8196ca7dcfeb7547aa09e9a7ead1873e9a8a5f489fc5c7334159e6f3a7f93e8628e12bd3e

Download Submit
C:\Users\Admin\AppData\Roaming\9AEE.C0A

Filesize
1KB

MD5
539af19b1a906c70e4a5979026a49e14

SHA1
ac88a512eb2ce2d9cf73a04511fb2f1f059fe542

SHA256
e443ab5383acb331adfed60fb6bd3bd5c4ebd63524324d8257578f317832daeb

SHA512
f2bc97c23ed20d3b174df37011b17b7676b5d226d1d36146b3ee90df24a5ccab876924c4d81c8b7919a231df8dee941e41ae9dbdc8984151262e79d6b483300a

Download Submit
C:\Users\Admin\AppData\Roaming\9AEE.C0A

Filesize
897B

MD5
d55df1d124de0cbff448ffb56132af76

SHA1
25fdd8bc6b99c82e55f876a3dbafe94a0285813f

SHA256
242d9b8a2e78e2b6847849b3945515cc4300342a77aa81094db17ea3ea509944

SHA512
629ae46c6313b8f0891cb1a2b6416616252545f60e8be987272427d732ce536933aa58e6b13f6859f8ef940c0c027f077ecf117e2a681da432bf2e675d38a21f

Download Submit
C:\Users\Admin\AppData\Roaming\9AEE.C0A

Filesize
1KB

MD5
1d69973dee405fa5c50bc8a39ddd3cea

SHA1
90631eb202fcf4049560ff87ccc5d77e99674c1b

SHA256
67a92f9674f1c6d7ad2cb44636de38ee3aba9f2c17f62b41d6c96e1876b64740

SHA512
7c7e1ca98e2fd65ad420439b79c1f855ef99c3923f61d786554f123b1d65e74a4f109a37355d712e9b46d47e80fd97450e2557ad6f044853f423890590b5decf

Download Submit
memory/1664-1-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1664-2-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1664-196-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1664-20-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2036-92-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2036-90-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2036-89-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2988-19-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2988-17-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing