cycbot | 2c404d422aef34d43a9314a81774169de410805bdf4f0bbcceacc99a3428cec4

General

Target

JaffaCakes118_285a0fe5693190534f8428ee7adbf367.exe
Size

184KB
MD5

285a0fe5693190534f8428ee7adbf367
SHA1

aaa02d70c669eef1142e57d95aa225f0e7804631
SHA256

2c404d422aef34d43a9314a81774169de410805bdf4f0bbcceacc99a3428cec4
SHA512

70f987598a509d07f7e2f034c56075df932acf84ab0a43069f4c341fa778608459c4fbf362ff0365ab946a714e0d15dd8e9412fd8274fb0de1dd74194c2259b2
SSDEEP

3072:wBZ5p2ZbLhatS+lk54YpeJtRRAoClwireGMFwisq46gZl8BXDIGYOQhaSC3urTZ:wBDp2ZbLc8+IpeJtfAoCNMFwisq46Ql3

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/3428-12-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral2/memory/3428-11-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral2/memory/4268-14-0x0000000000400000-0x0000000000451000-memory.dmp	family_cycbot
behavioral2/memory/4268-15-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral2/memory/1904-76-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot
behavioral2/memory/4268-177-0x0000000000400000-0x0000000000454000-memory.dmp	family_cycbot

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4268-2-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/3428-12-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/3428-11-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/4268-14-0x0000000000400000-0x0000000000451000-memory.dmp	upx
behavioral2/memory/4268-15-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/1904-75-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/1904-76-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/4268-177-0x0000000000400000-0x0000000000454000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_285a0fe5693190534f8428ee7adbf367.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 3428	4268	JaffaCakes118_285a0fe5693190534f8428ee7adbf367.exe	83
PID 4268 wrote to memory of 3428	4268	JaffaCakes118_285a0fe5693190534f8428ee7adbf367.exe	83
PID 4268 wrote to memory of 3428	4268	JaffaCakes118_285a0fe5693190534f8428ee7adbf367.exe	83
PID 4268 wrote to memory of 1904	4268	JaffaCakes118_285a0fe5693190534f8428ee7adbf367.exe	85
PID 4268 wrote to memory of 1904	4268	JaffaCakes118_285a0fe5693190534f8428ee7adbf367.exe	85
PID 4268 wrote to memory of 1904	4268	JaffaCakes118_285a0fe5693190534f8428ee7adbf367.exe	85

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_285a0fe5693190534f8428ee7adbf367.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_285a0fe5693190534f8428ee7adbf367.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_285a0fe5693190534f8428ee7adbf367.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_285a0fe5693190534f8428ee7adbf367.exe startC:\Program Files (x86)\LP\A05D\D7E.exe%C:\Program Files (x86)\LP\A05D
  2⤵
  PID:3428
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_285a0fe5693190534f8428ee7adbf367.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_285a0fe5693190534f8428ee7adbf367.exe startC:\Users\Admin\AppData\Roaming\DEB93\71DA0.exe%C:\Users\Admin\AppData\Roaming\DEB93
  2⤵
  PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DEB93\3D11.EB9

Filesize
1KB

MD5
6d63db16991033c428e1f38912c267a1

SHA1
eecc0bcfada7dd8a4d63ace3541434552562faf8

SHA256
4be18f7df8c0360d6b44ac78d69ff2d66c38f588ab70598daddc12c6e05d2fda

SHA512
b34fba3eaea99ed942753ee38803459ed09081b339795101d048f30a884ec6544c16ea67873d0922a5e82d445e6ecfc53873646235790c430fc6f404f2e985fc

Download Submit
C:\Users\Admin\AppData\Roaming\DEB93\3D11.EB9

Filesize
600B

MD5
d5d7d5fbfed84aca3339af8f53f68929

SHA1
19c349c1191ca2f7a13950dcb31af5a3742d7962

SHA256
d18ddd9d7140d043e1e2a9d3149b2e55ca417949bff60622f0a305bca13e08f8

SHA512
712a7ae65d29ceaefe2b74cb61ad6669176fd42a784da39a61f79ab92413cb31edb761c51bcce101919be0cfca548c3da359ebc5f40d4a4f96377f87810f57f6

Download Submit
C:\Users\Admin\AppData\Roaming\DEB93\3D11.EB9

Filesize
996B

MD5
29a430ca542e296d1571072af4be53ea

SHA1
4975d339f9f54bdc72dc653ff641f81eaa8be448

SHA256
198d19da4ee4e8d108e45524632c730f64c43bdc293bc33a537b3e549243a263

SHA512
f8834fd5987677d48a325d1a6b41c8c524845c747aeed673b4c02b2648f8b9aa3587234e86baf0737103f45444f25fbff1f729dd0e0508b1f2ba88207db153f6

Download Submit
memory/1904-76-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1904-75-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1904-74-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3428-11-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3428-12-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4268-14-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4268-15-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4268-1-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4268-2-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4268-177-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing