cycbot | 4e81bae511b99065b28c176ea9e52b6beb95910763c6557512e2cf602661e364

General

Target

JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4.exe
Size

176KB
MD5

2a6ca24fb83bed49712ee86abd8468f4
SHA1

83ea0dffae99431ea835b6ddaf391e4cafaae977
SHA256

4e81bae511b99065b28c176ea9e52b6beb95910763c6557512e2cf602661e364
SHA512

afe4150f3d3873d4b34f1588284b94b036736d9186b8164dc8406914a10942c5b25a6f9ea7990c2bcda31b22b70ba2a75c65e50f7b405b9e3999eb77ecc91373
SSDEEP

3072:OMEkbJqKLsAu9RDdQb1/JDj0nGt7XI9luYSFEHRlfxEOgC:OIbBsp/p05j0nGQlnSK3fqOgC

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1620-15-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/1692-16-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/2948-91-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot
behavioral1/memory/1692-158-0x0000000000400000-0x000000000046C000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1692-2-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1620-12-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1620-15-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1620-14-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1692-16-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2948-89-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2948-91-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1692-158-0x0000000000400000-0x000000000046C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1620	1692	JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4.exe	30
PID 1692 wrote to memory of 1620	1692	JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4.exe	30
PID 1692 wrote to memory of 1620	1692	JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4.exe	30
PID 1692 wrote to memory of 1620	1692	JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4.exe	30
PID 1692 wrote to memory of 2948	1692	JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4.exe	33
PID 1692 wrote to memory of 2948	1692	JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4.exe	33
PID 1692 wrote to memory of 2948	1692	JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4.exe	33
PID 1692 wrote to memory of 2948	1692	JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1620
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\4FD3.D94

Filesize
1KB

MD5
8175dc69d915a66b5c8f52e009306e95

SHA1
69dff54cf3f8954db04af414427a70ac7739aef8

SHA256
732792555473ffffba590e3a3438ead326d43f5d1937696ad89fa729f2c022a8

SHA512
f2d640472d7e25df72ab48eb1a9189b4eadb8aedfa891d24ef22e2562849aed29d4216310a5ce1f5299c4e30f54c20ba6b021f172efd501245bf4b7cf8131fff

Download Submit
C:\Users\Admin\AppData\Roaming\4FD3.D94

Filesize
600B

MD5
fee750e5fc01a475752a43844be65249

SHA1
891ad481523f5da7e2b08f581af5f912524f158c

SHA256
d7b1e89dde9bf13728f589c7198aa472fdba2b1a8cf35afa0908d9f2cf85e6a9

SHA512
38105f610f419f26778197fc9b8696db760238c3d68224e2178956e479d165969842dd055a52412856e905c09ca73960228466c66778c0a7808360aceb5cea84

Download Submit
C:\Users\Admin\AppData\Roaming\4FD3.D94

Filesize
996B

MD5
ee275dd449b88910589509b624b7bc1f

SHA1
b98e61520840a30149c436b8a46704efd8651824

SHA256
a286749c9678df77eef300a9e8f22cf4b9b5fdc048078aac9249a4ac926ac7be

SHA512
a381d895139de91ef521b5424c3114ef15795911327590070178e405ff8c9be91b207c0496bd25e6cc0a6767ef0e8de98d180bab2e2251c6559b0d46310e960d

Download Submit
memory/1620-12-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1620-15-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1620-14-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1692-1-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1692-2-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1692-16-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1692-158-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2948-89-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2948-91-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing